77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c

Analysis

max time kernel
12s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Size 267KB
Sample260809-tb9lbabb89
SHA256 77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c
MD5 ebbd61a0c8129b405807f15007a56c3d
SHA1 ad7003c711555e6af70073c2d64fa6631c2b6d37
SHA512 926db78584d9b22274ac82b36e1b3faa1919f8b99f62161a2338bb15d75fca147d84706abd818855ec8fd87ae3befb0a6d2e90f78ab158a53787d448179dbb85
SSDEEP 6144:R2wx/2X9U7kOehxZuE+GgQzSDa0tIWWfcjmrFD3pbW:z0X5Oeh+Ggcnqmld
TLSH
T12C44227B487847DFD17181BBC672B2C53D84BC6D8537342B56853BA82A2CD09A26CCBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
4388	5BC2.tmp
5928	5E33.tmp
4500	6027.tmp
1752	61DD.tmp
5992	6383.tmp
6120	6519.tmp
4984	678A.tmp
6088	696E.tmp
3060	6B62.tmp
6064	6CF9.tmp
3460	6EFC.tmp
5228	70B2.tmp
1792	72D5.tmp
1364	74B9.tmp
2236	7640.tmp
1276	7824.tmp
4988	79F9.tmp
4692	7BFC.tmp
4684	7D93.tmp
4224	7F38.tmp
2452	818A.tmp
1088	836F.tmp
3104	8563.tmp

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6519.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	678A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EFC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8563.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72D5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BC2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E33.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D93.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6027.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61DD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B62.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	818A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6383.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6CF9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BFC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70B2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7640.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7824.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	836F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F38.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	696E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79F9.tmp

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5928	5E33.tmp
Token: SeIncBasePriorityPrivilege	4388	5BC2.tmp
Token: SeIncBasePriorityPrivilege	4500	6027.tmp
Token: SeIncBasePriorityPrivilege	1752	61DD.tmp
Token: SeIncBasePriorityPrivilege	5992	6383.tmp
Token: SeIncBasePriorityPrivilege	6120	6519.tmp
Token: SeIncBasePriorityPrivilege	4984	678A.tmp
Token: SeIncBasePriorityPrivilege	6088	696E.tmp
Token: SeIncBasePriorityPrivilege	3060	6B62.tmp
Token: SeIncBasePriorityPrivilege	6064	6CF9.tmp
Token: SeIncBasePriorityPrivilege	3460	6EFC.tmp
Token: SeIncBasePriorityPrivilege	5228	70B2.tmp
Token: SeIncBasePriorityPrivilege	1792	72D5.tmp
Token: SeIncBasePriorityPrivilege	1364	74B9.tmp
Token: SeIncBasePriorityPrivilege	2236	7640.tmp
Token: SeIncBasePriorityPrivilege	1276	7824.tmp
Token: SeIncBasePriorityPrivilege	4988	79F9.tmp
Token: SeIncBasePriorityPrivilege	4692	7BFC.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2804	2300	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	90
PID 2300 wrote to memory of 4388	2300	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	91
PID 2804 wrote to memory of 3812	2804	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	92
PID 2804 wrote to memory of 5928	2804	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	93
PID 3812 wrote to memory of 4108	3812	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	94
PID 3812 wrote to memory of 4500	3812	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	95
PID 4108 wrote to memory of 2248	4108	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	96
PID 2248 wrote to memory of 6116	2248	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	97
PID 4108 wrote to memory of 1752	4108	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	98
PID 6116 wrote to memory of 3752	6116	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	99
PID 2248 wrote to memory of 5992	2248	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	100
PID 6116 wrote to memory of 6120	6116	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	101
PID 5928 wrote to memory of 5172	5928	5E33.tmp	102
PID 4388 wrote to memory of 3428	4388	5BC2.tmp	103
PID 3752 wrote to memory of 4744	3752	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	104
PID 3752 wrote to memory of 4984	3752	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	105
PID 4744 wrote to memory of 4928	4744	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	106
PID 4500 wrote to memory of 2904	4500	6027.tmp	107
PID 4928 wrote to memory of 3676	4928	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	108
PID 1752 wrote to memory of 5596	1752	61DD.tmp	109
PID 4744 wrote to memory of 6088	4744	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	110
PID 3676 wrote to memory of 1420	3676	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	111
PID 5992 wrote to memory of 5716	5992	6383.tmp	112
PID 4928 wrote to memory of 3060	4928	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	113
PID 6120 wrote to memory of 708	6120	6519.tmp	114
PID 1420 wrote to memory of 508	1420	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	115
PID 3676 wrote to memory of 6064	3676	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	116
PID 508 wrote to memory of 1608	508	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	117
PID 4984 wrote to memory of 1884	4984	678A.tmp	118
PID 1420 wrote to memory of 3460	1420	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	119
PID 508 wrote to memory of 5228	508	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	120
PID 1608 wrote to memory of 3536	1608	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	121
PID 6088 wrote to memory of 2444	6088	696E.tmp	122
PID 3536 wrote to memory of 6108	3536	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	123
PID 1608 wrote to memory of 1792	1608	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	124
PID 6108 wrote to memory of 4908	6108	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	125
PID 3060 wrote to memory of 1268	3060	6B62.tmp	126
PID 6064 wrote to memory of 1560	6064	6CF9.tmp	127
PID 3536 wrote to memory of 1364	3536	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	128
PID 4908 wrote to memory of 1112	4908	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	129
PID 6108 wrote to memory of 2236	6108	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	130
PID 3460 wrote to memory of 4680	3460	6EFC.tmp	131
PID 1112 wrote to memory of 5636	1112	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	132
PID 5228 wrote to memory of 3404	5228	70B2.tmp	133
PID 4908 wrote to memory of 1276	4908	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	134
PID 5636 wrote to memory of 4348	5636	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	135
PID 1112 wrote to memory of 4988	1112	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	136
PID 4348 wrote to memory of 2324	4348	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	137
PID 5636 wrote to memory of 4692	5636	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	138
PID 1792 wrote to memory of 96	1792	72D5.tmp	139
PID 2324 wrote to memory of 1804	2324	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	140
PID 4348 wrote to memory of 4684	4348	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	141
PID 1364 wrote to memory of 3332	1364	74B9.tmp	142
PID 1804 wrote to memory of 4184	1804	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	143
PID 2236 wrote to memory of 3792	2236	7640.tmp	144
PID 2324 wrote to memory of 4224	2324	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	145
PID 4184 wrote to memory of 4660	4184	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	146
PID 1804 wrote to memory of 2452	1804	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	147
PID 1276 wrote to memory of 5796	1276	7824.tmp	148
PID 4660 wrote to memory of 5412	4660	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	149
PID 4184 wrote to memory of 1088	4184	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	150
PID 5412 wrote to memory of 4220	5412	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	151
PID 4988 wrote to memory of 5532	4988	79F9.tmp	152
PID 4660 wrote to memory of 3104	4660	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	153

C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
"C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
  "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
    "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
      "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:508
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        19⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        21⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        23⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        24⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        26⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        27⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        28⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        29⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        30⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        31⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        32⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        33⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        34⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        35⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        36⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        37⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        38⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        39⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        40⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        41⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        42⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        43⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        44⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        45⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        46⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        47⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        48⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        49⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        50⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        51⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        52⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        53⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        54⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        55⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        56⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        57⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        58⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        59⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        60⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        61⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        62⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        63⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        64⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        65⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        66⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        67⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        68⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        69⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        70⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        71⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        72⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        73⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        74⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        75⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        76⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        77⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        78⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        79⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        80⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        81⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        82⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        83⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        84⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        85⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        86⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        87⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        88⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        89⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        90⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        91⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        92⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        93⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        94⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        95⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        96⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        97⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        98⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        99⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        100⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        101⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        102⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        103⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        104⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        105⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        106⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        107⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        108⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        109⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        110⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        111⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        112⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        113⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        114⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        115⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        116⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        117⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        118⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        119⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        120⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        121⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        122⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        123⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        124⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        125⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        126⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        127⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        128⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        129⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        130⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        131⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        132⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        133⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        134⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        135⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        136⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        137⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        138⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        139⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        140⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        141⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        142⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        143⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        144⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        145⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        146⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        147⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        148⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        149⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        150⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        151⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        152⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        153⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        154⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        155⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        156⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        157⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        158⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        159⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        160⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        161⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        162⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        163⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        164⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        165⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        166⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        167⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        168⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        169⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        170⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        171⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        172⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        173⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        174⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        175⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        176⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        177⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        178⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        179⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        180⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        181⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        182⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        183⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        184⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        185⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        186⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        187⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        188⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        189⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        190⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        191⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        192⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        193⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        194⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        195⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        196⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        197⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        198⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        199⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        200⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        201⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        202⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        203⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        204⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        205⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        206⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        207⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        208⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        209⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        210⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        211⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        212⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        213⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        214⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        215⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        216⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        217⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        218⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        219⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        220⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        221⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        222⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        223⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        224⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        225⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        226⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        227⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        228⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        229⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        230⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        231⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        232⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        233⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        234⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        235⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        236⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        237⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        238⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        239⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        240⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        241⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        242⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        243⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        244⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        245⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        246⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        247⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        248⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        249⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        250⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        251⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        252⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        253⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        254⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        255⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        256⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        257⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        258⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        259⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        260⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        261⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        262⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        263⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        264⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        265⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        266⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        267⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        268⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        269⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        270⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        271⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        272⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        273⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        274⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        275⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        276⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        277⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        278⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        279⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        280⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        281⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        282⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        283⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        284⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        285⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        286⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        287⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        288⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        289⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        290⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        291⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        292⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        293⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        294⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        295⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        296⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        297⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        298⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        299⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        300⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        301⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        302⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        303⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        304⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        305⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        306⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        307⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        308⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        309⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        310⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        311⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        312⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        313⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        314⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        315⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        316⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        317⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        318⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        319⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        320⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        321⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        322⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        323⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        324⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        325⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        326⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        327⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        328⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        329⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        330⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        331⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        332⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        333⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        334⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        335⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        336⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        337⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        338⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        339⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        340⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        341⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        342⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\9F59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F59.tmp"
        340⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\9DB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DB3.tmp"
        339⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\9C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C2D.tmp"
        338⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\9A68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A68.tmp"
        337⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\98C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98C2.tmp"
        336⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\974B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\974B.tmp"
        335⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\95D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95D4.tmp"
        334⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\95D4.tmp > nul
        335⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\93FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93FF.tmp"
        333⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\93FF.tmp > nul
        334⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\9278.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9278.tmp"
        332⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9278.tmp > nul
        333⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\90B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90B3.tmp"
        331⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\90B3.tmp > nul
        332⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\8EEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EEE.tmp"
        330⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8EEE.tmp > nul
        331⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\8D39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D39.tmp"
        329⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8D39.tmp > nul
        330⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\8B93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B93.tmp"
        328⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8B93.tmp > nul
        329⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\89BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89BE.tmp"
        327⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\89BE.tmp > nul
        328⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\8809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8809.tmp"
        326⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8809.tmp > nul
        327⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\8692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8692.tmp"
        325⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8692.tmp > nul
        326⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\84CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84CC.tmp"
        324⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\84CC.tmp > nul
        325⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\82AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82AA.tmp"
        323⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\82AA.tmp > nul
        324⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\80E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80E4.tmp"
        322⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\80E4.tmp > nul
        323⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\7EF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"
        321⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7EF0.tmp > nul
        322⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\7D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"
        320⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7D5A.tmp > nul
        321⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\7BB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BB4.tmp"
        319⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7BB4.tmp > nul
        320⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\7A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A5D.tmp"
        318⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7A5D.tmp > nul
        319⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\78C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78C6.tmp"
        317⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\78C6.tmp > nul
        318⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\76E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76E2.tmp"
        316⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\76E2.tmp > nul
        317⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\756B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\756B.tmp"
        315⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\756B.tmp > nul
        316⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\73E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73E4.tmp"
        314⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\73E4.tmp > nul
        315⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\71F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71F0.tmp"
        313⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\71F0.tmp > nul
        314⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\705A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\705A.tmp"
        312⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\705A.tmp > nul
        313⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\6EB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EB4.tmp"
        311⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6EB4.tmp > nul
        312⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\6D0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D0E.tmp"
        310⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6D0E.tmp > nul
        311⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\6B97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B97.tmp"
        309⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6B97.tmp > nul
        310⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\69E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69E2.tmp"
        308⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\69E2.tmp > nul
        309⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\683C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\683C.tmp"
        307⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\683C.tmp > nul
        308⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\66E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66E4.tmp"
        306⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\66E4.tmp > nul
        307⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\64C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C1.tmp"
        305⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64C1.tmp > nul
        306⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\630C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\630C.tmp"
        304⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\630C.tmp > nul
        305⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\6156.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6156.tmp"
        303⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6156.tmp > nul
        304⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\5F91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F91.tmp"
        302⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5F91.tmp > nul
        303⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\5DEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DEB.tmp"
        301⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5DEB.tmp > nul
        302⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\5C74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C74.tmp"
        300⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5C74.tmp > nul
        301⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\5A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A42.tmp"
        299⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5A42.tmp > nul
        300⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\58FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58FA.tmp"
        298⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\58FA.tmp > nul
        299⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\5773.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5773.tmp"
        297⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5773.tmp > nul
        298⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\557F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\557F.tmp"
        296⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\557F.tmp > nul
        297⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\53CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53CA.tmp"
        295⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53CA.tmp > nul
        296⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\5214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5214.tmp"
        294⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5214.tmp > nul
        295⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\509D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\509D.tmp"
        293⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\509D.tmp > nul
        294⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\4ED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ED8.tmp"
        292⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4ED8.tmp > nul
        293⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\4CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CF4.tmp"
        291⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4CF4.tmp > nul
        292⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\4B9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B9C.tmp"
        290⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4B9C.tmp > nul
        291⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\4A15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A15.tmp"
        289⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4A15.tmp > nul
        290⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\4840.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4840.tmp"
        288⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4840.tmp > nul
        289⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\45C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C0.tmp"
        287⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\45C0.tmp > nul
        288⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\442A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\442A.tmp"
        286⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\442A.tmp > nul
        287⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\4226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4226.tmp"
        285⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4226.tmp > nul
        286⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\4032.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4032.tmp"
        284⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4032.tmp > nul
        285⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\3E5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E5D.tmp"
        283⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3E5D.tmp > nul
        284⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\3C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C79.tmp"
        282⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3C79.tmp > nul
        283⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\3AA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AA4.tmp"
        281⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3AA4.tmp > nul
        282⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\38FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38FE.tmp"
        280⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\38FE.tmp > nul
        281⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\36CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36CC.tmp"
        279⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\36CC.tmp > nul
        280⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\34B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34B8.tmp"
        278⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\34B8.tmp > nul
        279⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\3332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3332.tmp"
        277⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3332.tmp > nul
        278⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\318C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\318C.tmp"
        276⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\318C.tmp > nul
        277⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\3005.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3005.tmp"
        275⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3005.tmp > nul
        276⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\2E50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E50.tmp"
        274⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2E50.tmp > nul
        275⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\2BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA0.tmp"
        273⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2BA0.tmp > nul
        274⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\2A1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1A.tmp"
        272⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2A1A.tmp > nul
        273⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\2835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2835.tmp"
        271⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2835.tmp > nul
        272⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\2651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2651.tmp"
        270⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2651.tmp > nul
        271⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\24EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24EA.tmp"
        269⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\24EA.tmp > nul
        270⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\22E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22E6.tmp"
        268⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\22E6.tmp > nul
        269⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\2102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2102.tmp"
        267⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2102.tmp > nul
        268⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\1F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9A.tmp"
        266⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1F9A.tmp > nul
        267⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\1DD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DD5.tmp"
        265⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1DD5.tmp > nul
        266⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\1BE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BE1.tmp"
        264⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1BE1.tmp > nul
        265⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\1980.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1980.tmp"
        263⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1980.tmp > nul
        264⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\17F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17F9.tmp"
        262⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\17F9.tmp > nul
        263⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\1624.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1624.tmp"
        261⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1624.tmp > nul
        262⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\1384.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1384.tmp"
        260⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1384.tmp > nul
        261⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\11DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11DF.tmp"
        259⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\11DF.tmp > nul
        260⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\F7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D.tmp"
        258⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F7D.tmp > nul
        259⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\D89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D89.tmp"
        257⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D89.tmp > nul
        258⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B86.tmp"
        256⤵
        
        PID:728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B86.tmp > nul
        257⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\9C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C0.tmp"
        255⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9C0.tmp > nul
        256⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\7BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BD.tmp"
        254⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7BD.tmp > nul
        255⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E8.tmp"
        253⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5E8.tmp > nul
        254⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\433.tmp"
        252⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\433.tmp > nul
        253⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\210.tmp"
        251⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\210.tmp > nul
        252⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\FFDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFDD.tmp"
        250⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FFDD.tmp > nul
        251⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\FD9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD9B.tmp"
        249⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FD9B.tmp > nul
        250⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\FBA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBA7.tmp"
        248⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FBA7.tmp > nul
        249⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\F994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F994.tmp"
        247⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F994.tmp > nul
        248⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\F7AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7AF.tmp"
        246⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F7AF.tmp > nul
        247⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\F5EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5EA.tmp"
        245⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F5EA.tmp > nul
        246⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\F416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F416.tmp"
        244⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F416.tmp > nul
        245⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\F27F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F27F.tmp"
        243⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F27F.tmp > nul
        244⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\F118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F118.tmp"
        242⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F118.tmp > nul
        243⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\EEE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEE5.tmp"
        241⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EEE5.tmp > nul
        242⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\ED01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED01.tmp"
        240⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ED01.tmp > nul
        241⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\EB3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB3C.tmp"
        239⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EB3C.tmp > nul
        240⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\E919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E919.tmp"
        238⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E919.tmp > nul
        239⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\E7B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7B2.tmp"
        237⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E7B2.tmp > nul
        238⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\E63B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E63B.tmp"
        236⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E63B.tmp > nul
        237⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\E447.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E447.tmp"
        235⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E447.tmp > nul
        236⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\E282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E282.tmp"
        234⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E282.tmp > nul
        235⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\E0BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0BC.tmp"
        233⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E0BC.tmp > nul
        234⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\DEF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEF7.tmp"
        232⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DEF7.tmp > nul
        233⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\DD32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD32.tmp"
        231⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DD32.tmp > nul
        232⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\DB9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB9C.tmp"
        230⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DB9C.tmp > nul
        231⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\DA73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA73.tmp"
        229⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DA73.tmp > nul
        230⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\D91B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D91B.tmp"
        228⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D91B.tmp > nul
        229⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\D795.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D795.tmp"
        227⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D795.tmp > nul
        228⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\D5FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5FE.tmp"
        226⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D5FE.tmp > nul
        227⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\D3DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3DC.tmp"
        225⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D3DC.tmp > nul
        226⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\D245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D245.tmp"
        224⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D245.tmp > nul
        225⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\D0CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0CE.tmp"
        223⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D0CE.tmp > nul
        224⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\CEFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEFA.tmp"
        222⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CEFA.tmp > nul
        223⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\CD73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD73.tmp"
        221⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CD73.tmp > nul
        222⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\CBDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBDD.tmp"
        220⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CBDD.tmp > nul
        221⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\CA66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA66.tmp"
        219⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CA66.tmp > nul
        220⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\C8A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8A1.tmp"
        218⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C8A1.tmp > nul
        219⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\C6EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6EB.tmp"
        217⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C6EB.tmp > nul
        218⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\C4C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4C8.tmp"
        216⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C4C8.tmp > nul
        217⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\C370.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C370.tmp"
        215⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C370.tmp > nul
        216⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\C1BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1BB.tmp"
        214⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C1BB.tmp > nul
        215⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\C034.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C034.tmp"
        213⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C034.tmp > nul
        214⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\BE8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"
        212⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BE8E.tmp > nul
        213⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\BCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAA.tmp"
        211⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BCAA.tmp > nul
        212⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\BB43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB43.tmp"
        210⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BB43.tmp > nul
        211⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\B98D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B98D.tmp"
        209⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B98D.tmp > nul
        210⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\B816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B816.tmp"
        208⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B816.tmp > nul
        209⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\B651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B651.tmp"
        207⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B651.tmp > nul
        208⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\B4AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4AB.tmp"
        206⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B4AB.tmp > nul
        207⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\B2F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2F6.tmp"
        205⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B2F6.tmp > nul
        206⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\B150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B150.tmp"
        204⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B150.tmp > nul
        205⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\AFF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFF8.tmp"
        203⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AFF8.tmp > nul
        204⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\AE52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE52.tmp"
        202⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AE52.tmp > nul
        203⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\ACDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACDB.tmp"
        201⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ACDB.tmp > nul
        202⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\AB26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB26.tmp"
        200⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AB26.tmp > nul
        201⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\A961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A961.tmp"
        199⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A961.tmp > nul
        200⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\A7EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"
        198⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A7EA.tmp > nul
        199⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\A644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A644.tmp"
        197⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A644.tmp > nul
        198⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\A4AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"
        196⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A4AD.tmp > nul
        197⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\A308.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A308.tmp"
        195⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A308.tmp > nul
        196⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\A162.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A162.tmp"
        194⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A162.tmp > nul
        195⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\A00A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A00A.tmp"
        193⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A00A.tmp > nul
        194⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\9E54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E54.tmp"
        192⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9E54.tmp > nul
        193⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\9D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"
        191⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9D2C.tmp > nul
        192⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\9B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B95.tmp"
        190⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9B95.tmp > nul
        191⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\9A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A0F.tmp"
        189⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9A0F.tmp > nul
        190⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\97FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97FB.tmp"
        188⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\97FB.tmp > nul
        189⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\9636.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9636.tmp"
        187⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9636.tmp > nul
        188⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\94B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B0.tmp"
        186⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\94B0.tmp > nul
        187⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\930A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\930A.tmp"
        185⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\930A.tmp > nul
        186⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\9145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9145.tmp"
        184⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9145.tmp > nul
        185⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\8F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F9F.tmp"
        183⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8F9F.tmp > nul
        184⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\8E37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E37.tmp"
        182⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8E37.tmp > nul
        183⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\8CD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CD0.tmp"
        181⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8CD0.tmp > nul
        182⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\8ABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ABD.tmp"
        180⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8ABD.tmp > nul
        181⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\8917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8917.tmp"
        179⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8917.tmp > nul
        180⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\8790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8790.tmp"
        178⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8790.tmp > nul
        179⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\8639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8639.tmp"
        177⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8639.tmp > nul
        178⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\8445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8445.tmp"
        176⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8445.tmp > nul
        177⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\827F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\827F.tmp"
        175⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\827F.tmp > nul
        176⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\8108.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8108.tmp"
        174⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8108.tmp > nul
        175⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\7F34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F34.tmp"
        173⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7F34.tmp > nul
        174⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\7D4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"
        172⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7D4F.tmp > nul
        173⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\7BA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BA9.tmp"
        171⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7BA9.tmp > nul
        172⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\79C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79C5.tmp"
        170⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\79C5.tmp > nul
        171⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\784E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\784E.tmp"
        169⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\784E.tmp > nul
        170⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\76C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76C7.tmp"
        168⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\76C7.tmp > nul
        169⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\74D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74D3.tmp"
        167⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\74D3.tmp > nul
        168⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\734D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\734D.tmp"
        166⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\734D.tmp > nul
        167⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\7178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7178.tmp"
        165⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7178.tmp > nul
        166⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\6FD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"
        164⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6FD2.tmp > nul
        165⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\6E4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"
        163⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6E4C.tmp > nul
        164⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\6C09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C09.tmp"
        162⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6C09.tmp > nul
        163⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\6AC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AC1.tmp"
        161⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6AC1.tmp > nul
        162⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\696A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\696A.tmp"
        160⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\696A.tmp > nul
        161⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\67D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67D3.tmp"
        159⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\67D3.tmp > nul
        160⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\668B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\668B.tmp"
        158⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\668B.tmp > nul
        159⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\6497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6497.tmp"
        157⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6497.tmp > nul
        158⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\634F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\634F.tmp"
        156⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\634F.tmp > nul
        157⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\617A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617A.tmp"
        155⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\617A.tmp > nul
        156⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\6023.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6023.tmp"
        154⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6023.tmp > nul
        155⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\5E7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"
        153⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5E7D.tmp > nul
        154⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\5CC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"
        152⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5CC7.tmp > nul
        153⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\5B31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B31.tmp"
        151⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5B31.tmp > nul
        152⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\596C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\596C.tmp"
        150⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\596C.tmp > nul
        151⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\5804.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5804.tmp"
        149⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5804.tmp > nul
        150⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\569D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\569D.tmp"
        148⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\569D.tmp > nul
        149⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\542C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\542C.tmp"
        147⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\542C.tmp > nul
        148⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\5286.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5286.tmp"
        146⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5286.tmp > nul
        147⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\5092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5092.tmp"
        145⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5092.tmp > nul
        146⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\4F69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F69.tmp"
        144⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4F69.tmp > nul
        145⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\4D95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D95.tmp"
        143⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4D95.tmp > nul
        144⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\4BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"
        142⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4BDF.tmp > nul
        143⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\4A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A58.tmp"
        141⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4A58.tmp > nul
        142⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\48B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48B3.tmp"
        140⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\48B3.tmp > nul
        141⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\474B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\474B.tmp"
        139⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\474B.tmp > nul
        140⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\4567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4567.tmp"
        138⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4567.tmp > nul
        139⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\43A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43A2.tmp"
        137⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\43A2.tmp > nul
        138⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\41EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41EC.tmp"
        136⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\41EC.tmp > nul
        137⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\4027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4027.tmp"
        135⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4027.tmp > nul
        136⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\3E23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E23.tmp"
        134⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3E23.tmp > nul
        135⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\3C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C8D.tmp"
        133⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3C8D.tmp > nul
        134⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\3A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"
        132⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3A7A.tmp > nul
        133⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\3809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3809.tmp"
        131⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3809.tmp > nul
        132⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\354A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\354A.tmp"
        130⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\354A.tmp > nul
        131⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\3356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3356.tmp"
        129⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3356.tmp > nul
        130⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\30C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30C6.tmp"
        128⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\30C6.tmp > nul
        129⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\2EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"
        127⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2EF1.tmp > nul
        128⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\2D89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D89.tmp"
        126⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2D89.tmp > nul
        127⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\2BD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"
        125⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2BD4.tmp > nul
        126⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\29F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29F0.tmp"
        124⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\29F0.tmp > nul
        125⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\2859.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2859.tmp"
        123⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2859.tmp > nul
        124⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\26F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26F2.tmp"
        122⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\26F2.tmp > nul
        123⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\251D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\251D.tmp"
        121⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\251D.tmp > nul
        122⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\2397.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2397.tmp"
        120⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2397.tmp > nul
        121⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\2210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2210.tmp"
        119⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2210.tmp > nul
        120⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\206A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\206A.tmp"
        118⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\206A.tmp > nul
        119⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\1EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"
        117⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1EF3.tmp > nul
        118⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\1D6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"
        116⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1D6C.tmp > nul
        117⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\1C15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C15.tmp"
        115⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1C15.tmp > nul
        116⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\1A40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A40.tmp"
        114⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1A40.tmp > nul
        115⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\1917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1917.tmp"
        113⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1917.tmp > nul
        114⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\1771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1771.tmp"
        112⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1771.tmp > nul
        113⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\15BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15BC.tmp"
        111⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\15BC.tmp > nul
        112⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\1445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1445.tmp"
        110⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1445.tmp > nul
        111⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\12ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12ED.tmp"
        109⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\12ED.tmp > nul
        110⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\10AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10AB.tmp"
        108⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\10AB.tmp > nul
        109⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15.tmp"
        107⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F15.tmp > nul
        108⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\D8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8E.tmp"
        106⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D8E.tmp > nul
        107⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\C65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C65.tmp"
        105⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C65.tmp > nul
        106⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACF.tmp"
        104⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ACF.tmp > nul
        105⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\948.tmp"
        103⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\948.tmp > nul
        104⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\735.tmp"
        102⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\735.tmp > nul
        103⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\57F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57F.tmp"
        101⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\57F.tmp > nul
        102⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418.tmp"
        100⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\418.tmp > nul
        101⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        99⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\291.tmp > nul
        100⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\11A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11A.tmp"
        98⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\11A.tmp > nul
        99⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\FF75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF75.tmp"
        97⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FF75.tmp > nul
        98⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\FDAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"
        96⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FDAF.tmp > nul
        97⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\FBEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"
        95⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FBEA.tmp > nul
        96⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\FAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"
        94⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FAA2.tmp > nul
        95⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\F8BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"
        93⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F8BE.tmp > nul
        94⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\F776.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F776.tmp"
        92⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F776.tmp > nul
        93⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\F5DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"
        91⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F5DF.tmp > nul
        92⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\F42A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F42A.tmp"
        90⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F42A.tmp > nul
        91⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\F2A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"
        89⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F2A3.tmp > nul
        90⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\F0EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"
        88⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F0EE.tmp > nul
        89⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\EF48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF48.tmp"
        87⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EF48.tmp > nul
        88⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\EDF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"
        86⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EDF0.tmp > nul
        87⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\EC79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC79.tmp"
        85⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EC79.tmp > nul
        86⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\EA85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA85.tmp"
        84⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EA85.tmp > nul
        85⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\E8EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"
        83⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E8EF.tmp > nul
        84⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\E778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E778.tmp"
        82⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E778.tmp > nul
        83⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\E601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E601.tmp"
        81⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E601.tmp > nul
        82⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\E40D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E40D.tmp"
        80⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E40D.tmp > nul
        81⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\E2B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"
        79⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E2B5.tmp > nul
        80⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\E19C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E19C.tmp"
        78⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E19C.tmp > nul
        79⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\E006.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E006.tmp"
        77⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E006.tmp > nul
        78⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\DECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DECD.tmp"
        76⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DECD.tmp > nul
        77⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\DD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD56.tmp"
        75⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DD56.tmp > nul
        76⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\D9AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"
        74⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D9AD.tmp > nul
        75⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\D807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D807.tmp"
        73⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D807.tmp > nul
        74⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\D680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D680.tmp"
        72⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D680.tmp > nul
        73⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\D4CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"
        71⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D4CB.tmp > nul
        72⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\D306.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D306.tmp"
        70⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D306.tmp > nul
        71⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\D140.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D140.tmp"
        69⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D140.tmp > nul
        70⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\CFC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"
        68⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFC9.tmp > nul
        69⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\CE04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE04.tmp"
        67⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CE04.tmp > nul
        68⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\CC8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"
        66⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CC8D.tmp > nul
        67⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\CB26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB26.tmp"
        65⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CB26.tmp > nul
        66⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\C913.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C913.tmp"
        64⤵
        
        PID:712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C913.tmp > nul
        65⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\C78C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C78C.tmp"
        63⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C78C.tmp > nul
        64⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\C5C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"
        62⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C5C7.tmp > nul
        63⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\C440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C440.tmp"
        61⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C440.tmp > nul
        62⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\C26C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C26C.tmp"
        60⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C26C.tmp > nul
        61⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\C114.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C114.tmp"
        59⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C114.tmp > nul
        60⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\BFAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"
        58⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BFAC.tmp > nul
        59⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\BE07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE07.tmp"
        57⤵
        
        PID:616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BE07.tmp > nul
        58⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\BC13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC13.tmp"
        56⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BC13.tmp > nul
        57⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\BA5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"
        55⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BA5D.tmp > nul
        56⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\B8C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"
        54⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B8C7.tmp > nul
        55⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\B731.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B731.tmp"
        53⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B731.tmp > nul
        54⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\B52D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B52D.tmp"
        52⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B52D.tmp > nul
        53⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\B3B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"
        51⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B3B6.tmp > nul
        52⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\B200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B200.tmp"
        50⤵
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B200.tmp > nul
        51⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\B0A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"
        49⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B0A9.tmp > nul
        50⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\AEA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"
        48⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AEA5.tmp > nul
        49⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\ACD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"
        47⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ACD0.tmp > nul
        48⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\AB0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"
        46⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AB0B.tmp > nul
        47⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\A985.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A985.tmp"
        45⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A985.tmp > nul
        46⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\A82D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A82D.tmp"
        44⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A82D.tmp > nul
        45⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\A677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A677.tmp"
        43⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A677.tmp > nul
        44⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\A4C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"
        42⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A4C2.tmp > nul
        43⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\A32C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A32C.tmp"
        41⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A32C.tmp > nul
        42⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\A128.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A128.tmp"
        40⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A128.tmp > nul
        41⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\9F92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F92.tmp"
        39⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9F92.tmp > nul
        40⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\9E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"
        38⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9E1B.tmp > nul
        39⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\9C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C36.tmp"
        37⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9C36.tmp > nul
        38⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\9A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A90.tmp"
        36⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9A90.tmp > nul
        37⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\990A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\990A.tmp"
        35⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\990A.tmp > nul
        36⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\9783.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9783.tmp"
        34⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9783.tmp > nul
        35⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\95AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95AE.tmp"
        33⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\95AE.tmp > nul
        34⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\93F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93F9.tmp"
        32⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\93F9.tmp > nul
        33⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\9263.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9263.tmp"
        31⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9263.tmp > nul
        32⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\9001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9001.tmp"
        30⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9001.tmp > nul
        31⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\8DFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"
        29⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8DFE.tmp > nul
        30⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\8C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C19.tmp"
        28⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8C19.tmp > nul
        29⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\8A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A73.tmp"
        27⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8A73.tmp > nul
        28⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\889F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\889F.tmp"
        26⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\889F.tmp > nul
        27⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\86F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86F9.tmp"
        25⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\86F9.tmp > nul
        26⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\8563.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8563.tmp"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8563.tmp > nul
        25⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\836F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\836F.tmp"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\836F.tmp > nul
        24⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\818A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\818A.tmp"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\818A.tmp > nul
        23⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\7F38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F38.tmp"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7F38.tmp > nul
        22⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\7D93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D93.tmp"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7D93.tmp > nul
        21⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\7BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7BFC.tmp > nul
        20⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\79F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79F9.tmp"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\79F9.tmp > nul
        19⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\7824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7824.tmp"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7824.tmp > nul
        18⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\7640.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7640.tmp"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7640.tmp > nul
        17⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\74B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B9.tmp"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\74B9.tmp > nul
        16⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\72D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72D5.tmp"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\72D5.tmp > nul
        15⤵
        
        PID:96
        
        C:\Users\Admin\AppData\Local\Temp\70B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70B2.tmp"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\70B2.tmp > nul
        14⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\6EFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6EFC.tmp > nul
        13⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\6CF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6CF9.tmp > nul
        12⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\6B62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B62.tmp"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6B62.tmp > nul
        11⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\696E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\696E.tmp"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\696E.tmp > nul
        10⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\678A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\678A.tmp"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\678A.tmp > nul
        9⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\6519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6519.tmp"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6519.tmp > nul
        8⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\6383.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6383.tmp"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6383.tmp > nul
        7⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\61DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61DD.tmp"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\61DD.tmp > nul
        6⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\6027.tmp
      "C:\Users\Admin\AppData\Local\Temp\6027.tmp"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6027.tmp > nul
        5⤵
        
        PID:2904
- - C:\Users\Admin\AppData\Local\Temp\5E33.tmp
    "C:\Users\Admin\AppData\Local\Temp\5E33.tmp"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5E33.tmp > nul
      4⤵
      PID:5172
- C:\Users\Admin\AppData\Local\Temp\5BC2.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5BC2.tmp > nul
    3⤵
    PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5BC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BC2.tmp
Size 9KB
SHA256 39dbd9bad495d47192f71767003b85fc128f41e078eeb155ae476d5c16623b7a
MD5 8067e337d956b982349ae09accafa9db
SHA1 bd608f264b8a71ed6b333398b4e1184bd5662f6b
SHA512 185c78327d210de8429e66c5315c9115b9c398671bd1cd2029153dd0f11f004adb800e04a45960251fdb38957b42400a800f1d667a769a59e0d201f1f3ae3069
SSDEEP 192:w0j+VHWCT2XzxsPxEI7N3zTleB+111YhxVzAGA01:hKgCTctsPxjFkIxYhwZ
TLSH
T14F127D5E225C9479C49C0EF60E6781E65EB03362C27E623C40C7C2DE87EAE67512F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-0-0x00000000021C0000-0x0000000002202000-memory.dmp

Download

memory/2300-2-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4388-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/5928-12-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads