902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9

Analysis

max time kernel
36s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe
Size 1.2MB
Sample260804-nlh88ayeqc
SHA256 902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9
MD5 4e9f23ad9a14910ce261922d9cf78a12
SHA1 092e1863c8d1afb1ff289329497ed74b13aeb9da
SHA512 677aa3d11f02c494342946accf6259c4ffdfe7639fbe018a8638c218db2f3f8e17c3f1cdb8eb6bcbda96b562381fac362200c6ac5faafaf74d3868bc0180a011
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh6:AylFHUv6ReIt0jSrO2
TLSH
T1BF457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2068	T3155.exe
5504	SMGF4.exe
5312	109MD.exe
2584	05QHX.exe
4452	T15SS.exe
408	0882H.exe
1828	22F15.exe
828	V1POB.exe
4584	1HL40.exe
3920	CT5E8.exe
4052	CC75C.exe
5892	U2GA6.exe
3912	XZ32X.exe
6020	2K1I4.exe
6080	IFSIC.exe
2816	26L52.exe
5216	D8ZCG.exe
5788	E8U6J.exe
5100	GSQU0.exe
4852	IYK40.exe
4716	0R075.exe
4844	2D9L6.exe
2364	J50XB.exe
2276	LF81E.exe
4504	F9691.exe
2344	R74KU.exe
2420	HL6N8.exe
2204	090TS.exe
3216	PMT78.exe
1244	5U12Z.exe
3440	76224.exe
1452	5G1K2.exe
5080	A2E5P.exe
5332	F93NX.exe
4392	JEFIQ.exe
2444	N3K6L.exe
5544	417OV.exe
1792	U9439.exe
6112	SC299.exe
3020	78O22.exe
2636	75782.exe
4516	UYY01.exe
680	HY3UL.exe
4528	62I0A.exe
2432	8492R.exe
2248	607VH.exe
6092	4569F.exe
4564	HI1OD.exe
5752	O90Y1.exe
1096	24710.exe
1148	3K3N2.exe
4920	58437.exe
5496	A3U47.exe
4620	4O1F5.exe
5184	6VMDB.exe
2436	10O4U.exe
3176	6W8B2.exe
5796	19YP4.exe
4696	1X0T4.exe
4164	U8JZ5.exe
5784	DVI59.exe
4864	4QE85.exe
1800	W6MUD.exe
2408	267H0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5T1PN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J1MZ8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IFSIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D9L6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10O4U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3VC84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F4V29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D9Q8C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3K3N2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0O64F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05QHX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC75C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IYK40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	090TS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F93NX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6VMDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LF81E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JEFIQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4QE85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1817I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Y4AZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S9YK3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26L52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19YP4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U8JZ5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DVI59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9BX9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T3155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	109MD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CT5E8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U2GA6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78O22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JO9I2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	V1POB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1HL40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	417OV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4569F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MJV6H.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EY287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Z7A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1O81X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2K1I4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1X0T4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A2E5P.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4O1F5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4I427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0882H.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HL6N8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U9439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W6MUD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0PO0P.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9X04N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	536UY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SC299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	O90Y1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3U47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T15SS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R74KU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HB3P8.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5000	902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe
5000	902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe
2068	T3155.exe
2068	T3155.exe
5504	SMGF4.exe
5504	SMGF4.exe
5312	109MD.exe
5312	109MD.exe
2584	05QHX.exe
2584	05QHX.exe
4452	T15SS.exe
4452	T15SS.exe
408	0882H.exe
408	0882H.exe
1828	22F15.exe
1828	22F15.exe
828	V1POB.exe
828	V1POB.exe
4584	1HL40.exe
4584	1HL40.exe
3920	CT5E8.exe
3920	CT5E8.exe
4052	CC75C.exe
4052	CC75C.exe
5892	U2GA6.exe
5892	U2GA6.exe
3912	XZ32X.exe
3912	XZ32X.exe
6020	2K1I4.exe
6020	2K1I4.exe
6080	IFSIC.exe
6080	IFSIC.exe
2816	26L52.exe
2816	26L52.exe
5216	D8ZCG.exe
5216	D8ZCG.exe
5788	E8U6J.exe
5788	E8U6J.exe
5100	GSQU0.exe
5100	GSQU0.exe
4852	IYK40.exe
4852	IYK40.exe
4716	0R075.exe
4716	0R075.exe
4844	2D9L6.exe
4844	2D9L6.exe
2364	J50XB.exe
2364	J50XB.exe
2276	LF81E.exe
2276	LF81E.exe
4504	F9691.exe
4504	F9691.exe
2344	R74KU.exe
2344	R74KU.exe
2420	HL6N8.exe
2420	HL6N8.exe
2204	090TS.exe
2204	090TS.exe
3216	PMT78.exe
3216	PMT78.exe
1244	5U12Z.exe
1244	5U12Z.exe
3440	76224.exe
3440	76224.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2068	5000	902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe	89
PID 2068 wrote to memory of 5504	2068	T3155.exe	90
PID 5504 wrote to memory of 5312	5504	SMGF4.exe	91
PID 5312 wrote to memory of 2584	5312	109MD.exe	92
PID 2584 wrote to memory of 4452	2584	05QHX.exe	93
PID 4452 wrote to memory of 408	4452	T15SS.exe	94
PID 408 wrote to memory of 1828	408	0882H.exe	95
PID 1828 wrote to memory of 828	1828	22F15.exe	96
PID 828 wrote to memory of 4584	828	V1POB.exe	97
PID 4584 wrote to memory of 3920	4584	1HL40.exe	98
PID 3920 wrote to memory of 4052	3920	CT5E8.exe	99
PID 4052 wrote to memory of 5892	4052	CC75C.exe	100
PID 5892 wrote to memory of 3912	5892	U2GA6.exe	101
PID 3912 wrote to memory of 6020	3912	XZ32X.exe	102
PID 6020 wrote to memory of 6080	6020	2K1I4.exe	103
PID 6080 wrote to memory of 2816	6080	IFSIC.exe	104
PID 2816 wrote to memory of 5216	2816	26L52.exe	105
PID 5216 wrote to memory of 5788	5216	D8ZCG.exe	106
PID 5788 wrote to memory of 5100	5788	E8U6J.exe	107
PID 5100 wrote to memory of 4852	5100	GSQU0.exe	108
PID 4852 wrote to memory of 4716	4852	IYK40.exe	109
PID 4716 wrote to memory of 4844	4716	0R075.exe	110
PID 4844 wrote to memory of 2364	4844	2D9L6.exe	111
PID 2364 wrote to memory of 2276	2364	J50XB.exe	112
PID 2276 wrote to memory of 4504	2276	LF81E.exe	113
PID 4504 wrote to memory of 2344	4504	F9691.exe	114
PID 2344 wrote to memory of 2420	2344	R74KU.exe	115
PID 2420 wrote to memory of 2204	2420	HL6N8.exe	116
PID 2204 wrote to memory of 3216	2204	090TS.exe	117
PID 3216 wrote to memory of 1244	3216	PMT78.exe	118
PID 1244 wrote to memory of 3440	1244	5U12Z.exe	119
PID 3440 wrote to memory of 1452	3440	76224.exe	120
PID 1452 wrote to memory of 5080	1452	5G1K2.exe	121
PID 5080 wrote to memory of 5332	5080	A2E5P.exe	122
PID 5332 wrote to memory of 4392	5332	F93NX.exe	123
PID 4392 wrote to memory of 2444	4392	JEFIQ.exe	124
PID 2444 wrote to memory of 5544	2444	N3K6L.exe	125
PID 5544 wrote to memory of 1792	5544	417OV.exe	126
PID 1792 wrote to memory of 6112	1792	U9439.exe	127
PID 6112 wrote to memory of 3020	6112	SC299.exe	128
PID 3020 wrote to memory of 2636	3020	78O22.exe	129
PID 2636 wrote to memory of 4516	2636	75782.exe	130
PID 4516 wrote to memory of 680	4516	UYY01.exe	131
PID 680 wrote to memory of 4528	680	HY3UL.exe	132
PID 4528 wrote to memory of 2432	4528	62I0A.exe	133
PID 2432 wrote to memory of 2248	2432	8492R.exe	134
PID 2248 wrote to memory of 6092	2248	607VH.exe	135
PID 6092 wrote to memory of 4564	6092	4569F.exe	136
PID 4564 wrote to memory of 5752	4564	HI1OD.exe	137
PID 5752 wrote to memory of 1096	5752	O90Y1.exe	138
PID 1096 wrote to memory of 1148	1096	24710.exe	139
PID 1148 wrote to memory of 4920	1148	3K3N2.exe	140
PID 4920 wrote to memory of 5496	4920	58437.exe	141
PID 5448 wrote to memory of 4620	5448	0O64F.exe	143
PID 4620 wrote to memory of 5184	4620	4O1F5.exe	144
PID 5184 wrote to memory of 2436	5184	6VMDB.exe	145
PID 2436 wrote to memory of 3176	2436	10O4U.exe	146
PID 3176 wrote to memory of 5796	3176	6W8B2.exe	147
PID 5796 wrote to memory of 4696	5796	19YP4.exe	148
PID 4696 wrote to memory of 4164	4696	1X0T4.exe	149
PID 4164 wrote to memory of 5784	4164	U8JZ5.exe	150
PID 5784 wrote to memory of 4864	5784	DVI59.exe	151
PID 4864 wrote to memory of 1800	4864	4QE85.exe	152
PID 1800 wrote to memory of 2408	1800	W6MUD.exe	153

C:\Users\Admin\AppData\Local\Temp\902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe
"C:\Users\Admin\AppData\Local\Temp\902650d28a9534d97b83ec249bb924c748f47b4cbafd6bbf5873904e00cc23b9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\T3155.exe
  "C:\Users\Admin\AppData\Local\Temp\T3155.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\SMGF4.exe
    "C:\Users\Admin\AppData\Local\Temp\SMGF4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\109MD.exe
      "C:\Users\Admin\AppData\Local\Temp\109MD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\05QHX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05QHX.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\T15SS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\T15SS.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\0882H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0882H.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\22F15.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22F15.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\V1POB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V1POB.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\1HL40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1HL40.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\CT5E8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CT5E8.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\CC75C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CC75C.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\U2GA6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U2GA6.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\XZ32X.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XZ32X.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\2K1I4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2K1I4.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\IFSIC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IFSIC.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\26L52.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26L52.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\D8ZCG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D8ZCG.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\E8U6J.exe
        
        "C:\Users\Admin\AppData\Local\Temp\E8U6J.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\GSQU0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GSQU0.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\IYK40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IYK40.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\0R075.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0R075.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\2D9L6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2D9L6.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\J50XB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J50XB.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\LF81E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LF81E.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\F9691.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F9691.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\R74KU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R74KU.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\HL6N8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HL6N8.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\090TS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\090TS.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\PMT78.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PMT78.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\5U12Z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5U12Z.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\76224.exe
        
        "C:\Users\Admin\AppData\Local\Temp\76224.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\5G1K2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5G1K2.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\A2E5P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A2E5P.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\F93NX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F93NX.exe"
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\JEFIQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JEFIQ.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\N3K6L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\N3K6L.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\417OV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\417OV.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\U9439.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U9439.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\SC299.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SC299.exe"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\78O22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\78O22.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\75782.exe
        
        "C:\Users\Admin\AppData\Local\Temp\75782.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\UYY01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UYY01.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\HY3UL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HY3UL.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\62I0A.exe
        
        "C:\Users\Admin\AppData\Local\Temp\62I0A.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\8492R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8492R.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\607VH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\607VH.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\4569F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4569F.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\HI1OD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HI1OD.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\O90Y1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\O90Y1.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\24710.exe
        
        "C:\Users\Admin\AppData\Local\Temp\24710.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\3K3N2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3K3N2.exe"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\58437.exe
        
        "C:\Users\Admin\AppData\Local\Temp\58437.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\A3U47.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A3U47.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\0O64F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0O64F.exe"
        55⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\4O1F5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4O1F5.exe"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\6VMDB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6VMDB.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\10O4U.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10O4U.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\6W8B2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6W8B2.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\19YP4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\19YP4.exe"
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\1X0T4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1X0T4.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\U8JZ5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U8JZ5.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\DVI59.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DVI59.exe"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\4QE85.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4QE85.exe"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\W6MUD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W6MUD.exe"
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\267H0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\267H0.exe"
        66⤵
        Executes dropped EXE
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\7F31X.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7F31X.exe"
        67⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\5T1PN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5T1PN.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\92K9F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\92K9F.exe"
        69⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\MJV6H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MJV6H.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\1817I.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1817I.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\0PO0P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0PO0P.exe"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\8Y4AZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8Y4AZ.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\EY287.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EY287.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\3Z7A3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3Z7A3.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\HB3P8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HB3P8.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\M3WS6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\M3WS6.exe"
        77⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\95AOO.exe
        
        "C:\Users\Admin\AppData\Local\Temp\95AOO.exe"
        78⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\S53B2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S53B2.exe"
        79⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\9X04N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9X04N.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\S9YK3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S9YK3.exe"
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\3VC84.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3VC84.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\H0492.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H0492.exe"
        83⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\1O81X.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1O81X.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\536UY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\536UY.exe"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\37I1O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\37I1O.exe"
        86⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\8TCM1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8TCM1.exe"
        87⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\D9Q8C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D9Q8C.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\4I427.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4I427.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\SG81R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SG81R.exe"
        90⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\0V496.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0V496.exe"
        91⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\JO9I2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JO9I2.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\F4V29.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F4V29.exe"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\J1MZ8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J1MZ8.exe"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\9BX9N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9BX9N.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\772Y5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\772Y5.exe"
        96⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\03WB0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\03WB0.exe"
        97⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\K1801.exe
        
        "C:\Users\Admin\AppData\Local\Temp\K1801.exe"
        98⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\565AA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\565AA.exe"
        99⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\XF6LN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XF6LN.exe"
        100⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\V012G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V012G.exe"
        101⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\F78DE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F78DE.exe"
        102⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\4050A.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4050A.exe"
        103⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\420FW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\420FW.exe"
        104⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\514Y8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\514Y8.exe"
        105⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\EO91W.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EO91W.exe"
        106⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\32YV7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\32YV7.exe"
        107⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\RGMP8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RGMP8.exe"
        108⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\F4XPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F4XPI.exe"
        109⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\3126Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3126Y.exe"
        110⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\LW50H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LW50H.exe"
        111⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\SH0JM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SH0JM.exe"
        112⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\83874.exe
        
        "C:\Users\Admin\AppData\Local\Temp\83874.exe"
        113⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\4R126.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4R126.exe"
        114⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Y09E3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Y09E3.exe"
        115⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\93SLP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\93SLP.exe"
        116⤵
        
        PID:508
        
        C:\Users\Admin\AppData\Local\Temp\ODU79.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ODU79.exe"
        117⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\1I2C3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1I2C3.exe"
        118⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\14KD5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\14KD5.exe"
        119⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\VV2NK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VV2NK.exe"
        120⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\3G9TY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3G9TY.exe"
        121⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\0L49W.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0L49W.exe"
        122⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\R451E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R451E.exe"
        123⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\GAH4F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GAH4F.exe"
        124⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\5B2I8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5B2I8.exe"
        125⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\KWBU0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KWBU0.exe"
        126⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\MR2JJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MR2JJ.exe"
        127⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\4T71N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4T71N.exe"
        128⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\V1CH5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V1CH5.exe"
        129⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\X6B09.exe
        
        "C:\Users\Admin\AppData\Local\Temp\X6B09.exe"
        130⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\T40Y1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\T40Y1.exe"
        131⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\6QAB0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6QAB0.exe"
        132⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Z3W11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Z3W11.exe"
        133⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\5M701.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5M701.exe"
        134⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\9W4S2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9W4S2.exe"
        135⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\JT261.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JT261.exe"
        136⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\ZE4L4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZE4L4.exe"
        137⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\GNO74.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GNO74.exe"
        138⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\JJ9U3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JJ9U3.exe"
        139⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\2X752.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2X752.exe"
        140⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\OW1OH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OW1OH.exe"
        141⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\7V2MQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7V2MQ.exe"
        142⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\1D22I.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1D22I.exe"
        143⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\WLWCT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WLWCT.exe"
        144⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\1A7YS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1A7YS.exe"
        145⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\1C21N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1C21N.exe"
        146⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\UE71R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UE71R.exe"
        147⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\49C9E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\49C9E.exe"
        148⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\D3TAU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D3TAU.exe"
        149⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\V7POQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V7POQ.exe"
        150⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\5Z96M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5Z96M.exe"
        151⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\OXU94.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OXU94.exe"
        152⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\JX7I1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JX7I1.exe"
        153⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\MT580.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MT580.exe"
        154⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\2B6U3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2B6U3.exe"
        155⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\U2PV4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U2PV4.exe"
        156⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\O0791.exe
        
        "C:\Users\Admin\AppData\Local\Temp\O0791.exe"
        157⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\A44F2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A44F2.exe"
        158⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\V2Z69.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V2Z69.exe"
        159⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\83N55.exe
        
        "C:\Users\Admin\AppData\Local\Temp\83N55.exe"
        160⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\5V290.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5V290.exe"
        161⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\GDRV2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDRV2.exe"
        162⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\3FF58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3FF58.exe"
        163⤵
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\1BWY7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1BWY7.exe"
        164⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\MVS33.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MVS33.exe"
        165⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\31Y23.exe
        
        "C:\Users\Admin\AppData\Local\Temp\31Y23.exe"
        166⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\99IF1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\99IF1.exe"
        167⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\AH03Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AH03Y.exe"
        168⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\37K42.exe
        
        "C:\Users\Admin\AppData\Local\Temp\37K42.exe"
        169⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\13BZ1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13BZ1.exe"
        170⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\R7EM1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R7EM1.exe"
        171⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\10ZJ7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10ZJ7.exe"
        172⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\HN9L7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HN9L7.exe"
        173⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\0SV3B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0SV3B.exe"
        174⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\544LT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\544LT.exe"
        175⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\J7A5E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J7A5E.exe"
        176⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\1HZDK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1HZDK.exe"
        177⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\FH75D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FH75D.exe"
        178⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\KLKLL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KLKLL.exe"
        179⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\6SSQS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6SSQS.exe"
        180⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\XIDWL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XIDWL.exe"
        181⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\0KQ2P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0KQ2P.exe"
        182⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\8G5HF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8G5HF.exe"
        183⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\62TQP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\62TQP.exe"
        184⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\YT9TC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YT9TC.exe"
        185⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\3N4HY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3N4HY.exe"
        186⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\BP91C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BP91C.exe"
        187⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\6JOH1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6JOH1.exe"
        188⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\4FN90.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4FN90.exe"
        189⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\IHG55.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IHG55.exe"
        190⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\8Y125.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8Y125.exe"
        191⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\VJE4L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VJE4L.exe"
        192⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\T7H58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\T7H58.exe"
        193⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\08ECJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\08ECJ.exe"
        194⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\ISD5H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ISD5H.exe"
        195⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\LO6CF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LO6CF.exe"
        196⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\J8VU5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J8VU5.exe"
        197⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\40ARS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\40ARS.exe"
        198⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\389WB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\389WB.exe"
        199⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\13749.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13749.exe"
        200⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\M04O8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\M04O8.exe"
        201⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\8I2BJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8I2BJ.exe"
        202⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\5N7F2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5N7F2.exe"
        203⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\99XI2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\99XI2.exe"
        204⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\GG8S9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GG8S9.exe"
        205⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\5G68B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5G68B.exe"
        206⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\2XKRM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2XKRM.exe"
        207⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\7376E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7376E.exe"
        208⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\6D90L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6D90L.exe"
        209⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\0COUD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0COUD.exe"
        210⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\0RF8U.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0RF8U.exe"
        211⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\8NEEK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8NEEK.exe"
        212⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\6D55V.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6D55V.exe"
        213⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\XLW06.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XLW06.exe"
        214⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\BH0F4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BH0F4.exe"
        215⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\XQI77.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XQI77.exe"
        216⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\NA01L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NA01L.exe"
        217⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\QW9OB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QW9OB.exe"
        218⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\YW19K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YW19K.exe"
        219⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\D6C77.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D6C77.exe"
        220⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\L82M7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L82M7.exe"
        221⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\DY3A1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DY3A1.exe"
        222⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\W290K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W290K.exe"
        223⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\QRUAG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QRUAG.exe"
        224⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\0NL7W.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0NL7W.exe"
        225⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\J2356.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J2356.exe"
        226⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\7758T.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7758T.exe"
        227⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\0B42G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0B42G.exe"
        228⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\ICRMY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ICRMY.exe"
        229⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\N991R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\N991R.exe"
        230⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\326EN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\326EN.exe"
        231⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\K4M04.exe
        
        "C:\Users\Admin\AppData\Local\Temp\K4M04.exe"
        232⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\H29B6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H29B6.exe"
        233⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\8LXRR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8LXRR.exe"
        234⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\N1Q15.exe
        
        "C:\Users\Admin\AppData\Local\Temp\N1Q15.exe"
        235⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\400W7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\400W7.exe"
        236⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\YB4G6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YB4G6.exe"
        237⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\7WW10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7WW10.exe"
        238⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\R0W7V.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R0W7V.exe"
        239⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\JM49Q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JM49Q.exe"
        240⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\E5NPJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\E5NPJ.exe"
        241⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\IN7SC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IN7SC.exe"
        242⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\401ZD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\401ZD.exe"
        243⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\9D1DW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9D1DW.exe"
        244⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Q1YJK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Q1YJK.exe"
        245⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\3106T.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3106T.exe"
        246⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\16AU0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\16AU0.exe"
        247⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\L9WJ6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L9WJ6.exe"
        248⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\SXJ1V.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SXJ1V.exe"
        249⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\20BF5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\20BF5.exe"
        250⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\IV6DX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IV6DX.exe"
        251⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\RY8E9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RY8E9.exe"
        252⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\QHAZ0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QHAZ0.exe"
        253⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\ZUZ13.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZUZ13.exe"
        254⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\OD0Q5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OD0Q5.exe"
        255⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\76Z8F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\76Z8F.exe"
        256⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\9760E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9760E.exe"
        257⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\4M6KW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4M6KW.exe"
        258⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\2IR9N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2IR9N.exe"
        259⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\VT80Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VT80Y.exe"
        260⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\5J0KS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5J0KS.exe"
        261⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\01S7K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\01S7K.exe"
        262⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\IV09Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IV09Y.exe"
        263⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\HU28Z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HU28Z.exe"
        264⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\TQ9TX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TQ9TX.exe"
        265⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\F1K6Q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F1K6Q.exe"
        266⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\FKG1D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FKG1D.exe"
        267⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\64ONT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\64ONT.exe"
        268⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\3FN8R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3FN8R.exe"
        269⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\50KM8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\50KM8.exe"
        270⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\U3VG0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U3VG0.exe"
        271⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\56J9T.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56J9T.exe"
        272⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\YVXJP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\YVXJP.exe"
        273⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\09182.exe
        
        "C:\Users\Admin\AppData\Local\Temp\09182.exe"
        274⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\5G1Q9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5G1Q9.exe"
        275⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\12GT4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\12GT4.exe"
        276⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\G1794.exe
        
        "C:\Users\Admin\AppData\Local\Temp\G1794.exe"
        277⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\72RYN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\72RYN.exe"
        278⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\6O3CO.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6O3CO.exe"
        279⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\4K20E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4K20E.exe"
        280⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\MM7MI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MM7MI.exe"
        281⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\5F2BE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5F2BE.exe"
        282⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\72DDL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\72DDL.exe"
        283⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\14HL6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\14HL6.exe"
        284⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\0J0S7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0J0S7.exe"
        285⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\G2UV1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\G2UV1.exe"
        286⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\2F0F7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2F0F7.exe"
        287⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\S3I4L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S3I4L.exe"
        288⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\W80WK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W80WK.exe"
        289⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\2152F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2152F.exe"
        290⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\VNM5V.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VNM5V.exe"
        291⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\9Y0IR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9Y0IR.exe"
        292⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\4D63P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4D63P.exe"
        293⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\RYG18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RYG18.exe"
        294⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\06A6Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\06A6Y.exe"
        295⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\54CAR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\54CAR.exe"
        296⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\6181H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6181H.exe"
        297⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\9O4Z1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9O4Z1.exe"
        298⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\N2YV8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\N2YV8.exe"
        299⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\7T94R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7T94R.exe"
        300⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\P1XS8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\P1XS8.exe"
        301⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\1E8D2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1E8D2.exe"
        302⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\6MN64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6MN64.exe"
        303⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\78V7T.exe
        
        "C:\Users\Admin\AppData\Local\Temp\78V7T.exe"
        304⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\FDRGW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FDRGW.exe"
        305⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\LM28P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LM28P.exe"
        306⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\4J3DF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4J3DF.exe"
        307⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\31PZ7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\31PZ7.exe"
        308⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\BBGB9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BBGB9.exe"
        309⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\8DUY5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8DUY5.exe"
        310⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\389QN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\389QN.exe"
        311⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\6569L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6569L.exe"
        312⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\61S5G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\61S5G.exe"
        313⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\L05ZT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L05ZT.exe"
        314⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\A0R2E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A0R2E.exe"
        315⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\D1J66.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D1J66.exe"
        316⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\B6KA7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B6KA7.exe"
        317⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\WOME4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WOME4.exe"
        318⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\8QAS2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8QAS2.exe"
        319⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\ED7V0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ED7V0.exe"
        320⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\F826M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F826M.exe"
        321⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\B6HUW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B6HUW.exe"
        322⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\D1F4C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D1F4C.exe"
        323⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\BOI6N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BOI6N.exe"
        324⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Z242J.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Z242J.exe"
        325⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\ZJB4W.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZJB4W.exe"
        326⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\1580R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1580R.exe"
        327⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\B1IO6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\B1IO6.exe"
        328⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\GC288.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GC288.exe"
        329⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\JU521.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JU521.exe"
        330⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\G3R3H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\G3R3H.exe"
        331⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\N5PJM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\N5PJM.exe"
        332⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\72NC6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\72NC6.exe"
        333⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\76B5F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\76B5F.exe"
        334⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\85B9N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\85B9N.exe"
        335⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\3RV2O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3RV2O.exe"
        336⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\JY71P.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JY71P.exe"
        337⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\EFNJG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EFNJG.exe"
        338⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\C12N2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C12N2.exe"
        339⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\XI039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XI039.exe"
        340⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\AEDF8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AEDF8.exe"
        341⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\A7XW8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A7XW8.exe"
        342⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\TGZ6M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TGZ6M.exe"
        343⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\1958H.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1958H.exe"
        344⤵
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\573GZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\573GZ.exe"
        345⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\54F6Q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\54F6Q.exe"
        346⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\123PA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\123PA.exe"
        347⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\C2S4K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C2S4K.exe"
        348⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\7UB6R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7UB6R.exe"
        349⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\O1GZ6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\O1GZ6.exe"
        350⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\68355.exe
        
        "C:\Users\Admin\AppData\Local\Temp\68355.exe"
        351⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\631J4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\631J4.exe"
        352⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\86532.exe
        
        "C:\Users\Admin\AppData\Local\Temp\86532.exe"
        353⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\FL989.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FL989.exe"
        354⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\U2Y11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\U2Y11.exe"
        355⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\6G851.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6G851.exe"
        356⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\TCF49.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TCF49.exe"
        357⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\L7775.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L7775.exe"
        358⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\I55G3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I55G3.exe"
        359⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\4H243.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4H243.exe"
        360⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\QYMH3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QYMH3.exe"
        361⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\007E6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\007E6.exe"
        362⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\0OZ90.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0OZ90.exe"
        363⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\PK4F7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PK4F7.exe"
        364⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\WJGP6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WJGP6.exe"
        365⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\2DU11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2DU11.exe"
        366⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\S3HXI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S3HXI.exe"
        367⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Y6KK7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Y6KK7.exe"
        368⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\30Y43.exe
        
        "C:\Users\Admin\AppData\Local\Temp\30Y43.exe"
        369⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\DKMN3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DKMN3.exe"
        370⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\NLAB9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NLAB9.exe"
        371⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\OCL89.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OCL89.exe"
        372⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\53S6X.exe
        
        "C:\Users\Admin\AppData\Local\Temp\53S6X.exe"
        373⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\F8A6D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F8A6D.exe"
        374⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\L544L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\L544L.exe"
        375⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Y81GZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Y81GZ.exe"
        376⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\S6R1S.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S6R1S.exe"
        377⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\F13H9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F13H9.exe"
        378⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\98098.exe
        
        "C:\Users\Admin\AppData\Local\Temp\98098.exe"
        379⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Q53IQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Q53IQ.exe"
        380⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\T909G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\T909G.exe"
        381⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\X6I9F.exe
        
        "C:\Users\Admin\AppData\Local\Temp\X6I9F.exe"
        382⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\3AHWD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3AHWD.exe"
        383⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\D40AW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D40AW.exe"
        384⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\3M70S.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3M70S.exe"
        385⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\HN1UN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HN1UN.exe"
        386⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\CN09G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CN09G.exe"
        387⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\HSFLW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HSFLW.exe"
        388⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\JXEHU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JXEHU.exe"
        389⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\MU44K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MU44K.exe"
        390⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\5E3JG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5E3JG.exe"
        391⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\BZF3L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BZF3L.exe"
        392⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\TBBUG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TBBUG.exe"
        393⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\W2E02.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W2E02.exe"
        394⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\80P07.exe
        
        "C:\Users\Admin\AppData\Local\Temp\80P07.exe"
        395⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\306V7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\306V7.exe"
        396⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\R0C61.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R0C61.exe"
        397⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\03J6B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\03J6B.exe"
        398⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\66Q48.exe
        
        "C:\Users\Admin\AppData\Local\Temp\66Q48.exe"
        399⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\06BQ8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\06BQ8.exe"
        400⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\C1RT0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C1RT0.exe"
        401⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\J188O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\J188O.exe"
        402⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\52OYT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\52OYT.exe"
        403⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\156UU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\156UU.exe"
        404⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\QTA8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\QTA8M.exe"
        405⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\PA67O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PA67O.exe"
        406⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\4D1HT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4D1HT.exe"
        407⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\WLB4C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WLB4C.exe"
        408⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\5EPTY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5EPTY.exe"
        409⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\6371O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6371O.exe"
        410⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\W1DV2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W1DV2.exe"
        411⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Z8U11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Z8U11.exe"
        412⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\BNTNH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BNTNH.exe"
        413⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\XW40R.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XW40R.exe"
        414⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\5QSCE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5QSCE.exe"
        415⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\X0OZJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\X0OZJ.exe"
        416⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\84KNE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\84KNE.exe"
        417⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\FIS03.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FIS03.exe"
        418⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\UZ3Q3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\UZ3Q3.exe"
        419⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\7AQVH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7AQVH.exe"
        420⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\78MOB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\78MOB.exe"
        421⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\W6I9G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W6I9G.exe"
        422⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\392R8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\392R8.exe"
        423⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\I9460.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I9460.exe"
        424⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\0M043.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0M043.exe"
        425⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\486R5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\486R5.exe"
        426⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\R9ZT5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R9ZT5.exe"
        427⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\72NI1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\72NI1.exe"
        428⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\79315.exe
        
        "C:\Users\Admin\AppData\Local\Temp\79315.exe"
        429⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\42H40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\42H40.exe"
        430⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\1CFVV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1CFVV.exe"
        431⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\6CH4N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6CH4N.exe"
        432⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\X106B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\X106B.exe"
        433⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\RXPXT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RXPXT.exe"
        434⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\W603C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W603C.exe"
        435⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\86R2L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\86R2L.exe"
        436⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\644UW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\644UW.exe"
        437⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\27EYW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\27EYW.exe"
        438⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\0YV3N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0YV3N.exe"
        439⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\0M1QL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0M1QL.exe"
        440⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\5D40V.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5D40V.exe"
        441⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\219HT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\219HT.exe"
        442⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\K449X.exe
        
        "C:\Users\Admin\AppData\Local\Temp\K449X.exe"
        443⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\TWY6L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TWY6L.exe"
        444⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\I161M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\I161M.exe"
        445⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\X1MAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\X1MAX.exe"
        446⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\V75ES.exe
        
        "C:\Users\Admin\AppData\Local\Temp\V75ES.exe"
        447⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\P5332.exe
        
        "C:\Users\Admin\AppData\Local\Temp\P5332.exe"
        448⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\D5S70.exe
        
        "C:\Users\Admin\AppData\Local\Temp\D5S70.exe"
        449⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\2A0KI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2A0KI.exe"
        450⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\82TU0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\82TU0.exe"
        451⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\Z6H96.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Z6H96.exe"
        452⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\FLK08.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FLK08.exe"
        453⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\IZB05.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IZB05.exe"
        454⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\KFAV1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KFAV1.exe"
        455⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\4GO97.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4GO97.exe"
        456⤵
        
        PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05QHX.exe

Path C:\Users\Admin\AppData\Local\Temp\05QHX.exe
Size 1.2MB
SHA256 e5916a3fa89cc5e5295b7697c80e88b2645f64c01eb3ffd3c9a1d0fc716e0776
MD5 7eb8ed7b1ba27310742b931d3d0666e5
SHA1 835d0a82583f9fab8b2cb50365259f3f43bd69f5
SHA512 50728c42ddffb898adc46838e5a9c59ca6ff05c1abe4a95ae4b1070ae2eecc33011b971b324e7d5c8a37fd3b7ff2a12033c541415bb199608c4af1ad27891512
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhQ:AylFHUv6ReIt0jSrO8
TLSH
T180457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0882H.exe

Path C:\Users\Admin\AppData\Local\Temp\0882H.exe
Size 1.2MB
SHA256 deef3f0c33d8362c8d7dfd61b379eb6b114b65cf2ceb226d40bf61541ec9009f
MD5 8b5ae37da50bea4acd15601d8d36b44f
SHA1 17e532f9ffe8fbf689b4b6bfe47dcab815fd8780
SHA512 d032c0bca18805d16f8bfab06ea206cb4cb5ed59c69f27f4687afa9afebf1285eebc1179b3ee0c397eb5864df6e950fdf9d67185267d2f5449b6f4a03ff89890
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhz:AylFHUv6ReIt0jSrOv
TLSH
T10C457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

090TS.exe

Path C:\Users\Admin\AppData\Local\Temp\090TS.exe
Size 1.2MB
SHA256 eb670b6a43c131c85478c1a9e424cd1e66e966a38cb7aaa797287765c402149a
MD5 38f7d61a81a94f02262106573a42c261
SHA1 15cafba58326c78a592db49031d257449f5b9c03
SHA512 3827cd8612b95f55acdae34fe45df892f12252f5141c3dc5270094bb00906bf65a4a131740793d36545086d6c0b24c519d16d0a523a0b00649df6417250ec92c
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhP:AylFHUv6ReIt0jSrOr
TLSH
T137457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0R075.exe

Path C:\Users\Admin\AppData\Local\Temp\0R075.exe
Size 1.2MB
SHA256 3ee1d87e95db3e6274e38b6c35ab952b6bb78149edc85f3eef310cb5bcecb9f5
MD5 73a3c82d828259f2fc17f10c9f703c72
SHA1 b3481852be24137e346e720b5469192d95fd2bf7
SHA512 2621aa65fecfd1e1ffc583c54063dda3213ff2bbf220821f078a598868f7f2e54895a5aaf909a57044cc4d5c35a27b63419b75de06e371d20d578ef8aa9b6caf
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhp:AylFHUv6ReIt0jSrOF
TLSH
T1C8457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

109MD.exe

Path C:\Users\Admin\AppData\Local\Temp\109MD.exe
Size 1.2MB
SHA256 71a62a706108f9e77e335813ffa1e0b46cfb028ec833c45d4ba9e35ba4493411
MD5 ea55db83c8d5d37e73400330dfa39497
SHA1 1582370441b30d0d8d75f1a1e4d7b0ea95bcb2b7
SHA512 32421855032aac531a243836c1ee44ff7537e848bc07026245c0d90dcc373906ed1dff157d68323fbcd6d10f9631fa8bb85175b9fd03bfc6855f6525f06ad33b
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh2:AylFHUv6ReIt0jSrO6
TLSH
T11E457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1HL40.exe

Path C:\Users\Admin\AppData\Local\Temp\1HL40.exe
Size 1.2MB
SHA256 80fa8fb9ebfa292e37ab226ac9c7a4b2fcac8185a0635280bdc9e4b8b5b4af83
MD5 e73cd914211153da68cf3a77c3e51d82
SHA1 3a068dc23b6e6cae993bd7a3be507f532a199a22
SHA512 56cf802f0671280bedfd45c3d4fda8f781e39d9571870b37d494afce54a3ee0f7dd92ca6a5c5fde61a05cbcb40b4ccbf9bc83d26aca5d059b01ff9026b0910c7
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhq:AylFHUv6ReIt0jSrOm
TLSH
T173457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22F15.exe

Path C:\Users\Admin\AppData\Local\Temp\22F15.exe
Size 1.2MB
SHA256 8418dcd399f9d550b909f6c659d257d02d57a225d15e6fcbb4ce798f01068e45
MD5 9a69a9743efd2d50e6dc528a3d96ad5b
SHA1 40c1b90128d4e09cfdc1667eca6c70523f87084b
SHA512 3646d96ccad67f78cb7557afbc9e78277f59e5a946dbeb7164a37b1e779fc148d9b869543bdb6e2524134a30eed6b966adf061fe33de3685783ddab47871de51
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhl:AylFHUv6ReIt0jSrOx
TLSH
T11F457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26L52.exe

Path C:\Users\Admin\AppData\Local\Temp\26L52.exe
Size 1.2MB
SHA256 91cc8aa4df112276a9be94ae9a4c07ef0109557330dd0738692929d93d70565b
MD5 199a7173356791ee195c41b66dcda147
SHA1 a3787f718985f1b528cb6efd39c2e3f916f0e207
SHA512 965b362b154e33509291e1334c55a229151c37388587170ffad8198c2d7d15e782a2a85c8026b1a2b43501c0d2ebf6c1fd1f59fe7d45cdbf1a0e3ac8c95f69c3
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh2:AylFHUv6ReIt0jSrOy
TLSH
T151457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D9L6.exe

Path C:\Users\Admin\AppData\Local\Temp\2D9L6.exe
Size 1.2MB
SHA256 dcbfa63c4bce80bc323ab5abd43be082a27b708e02299a193852f78fb7c8b847
MD5 b01f9d46acc03a0ceb4c6798eb1d3de4
SHA1 0ce2377f392100f0f930558bed4d1cae703343d3
SHA512 4b68d39e1dd0b6f116dd5c6d0771665bbca828397e6d2569b6b46d75aadea0c29071ea73dfd24942a8231691675a700a9d0a9d3bee283329f9dd58a5d9f2ce4a
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhC:AylFHUv6ReIt0jSrOG
TLSH
T182457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2K1I4.exe

Path C:\Users\Admin\AppData\Local\Temp\2K1I4.exe
Size 1.2MB
SHA256 4aae2d23cb1e4c7f22681881182f31ac6f59f9aed8946ca231ae31918b8cd9e7
MD5 14be88c46152b12ad1d1739fb81e41f3
SHA1 21a39b012dda13d5df34b025ccdbe607cba1f15d
SHA512 81a58181194d46e969855fd521190cb16153b7b9ba7b2555be3f60bc8049c2857c4153d606228614935180f7cf50f4cfe1055e9a85c39b0c6d34f1b355ad0ed9
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh9:AylFHUv6ReIt0jSrOh
TLSH
T177457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5G1K2.exe

Path C:\Users\Admin\AppData\Local\Temp\5G1K2.exe
Size 1.2MB
SHA256 6e65505f7e322781381e7533a7f30a3102016013650fcfd859fac86fa2f65e28
MD5 78700c5b214312b89e368452d19cbde7
SHA1 6a701cc4d0e6ef89d94790b961a1be6b28b41916
SHA512 affc702c2564e3226f6f1650e32171af907ac8ebdf36b930bb7388165691d804d23ae2a480168074f089391ce3ce915ef112276c66010e85a39c9756d0cb109b
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhi:AylFHUv6ReIt0jSrOe
TLSH
T173457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5U12Z.exe

Path C:\Users\Admin\AppData\Local\Temp\5U12Z.exe
Size 1.2MB
SHA256 d4fc426fb0310c0c7919d2706c7137ef0df06e76272a541f97236b88bed3f363
MD5 ae2f2108d1259e9cac3b9c1bb5a87054
SHA1 2b66a70126f29a18b2afe8e6dad123eddd77e9e7
SHA512 20bde41141211117873c9ce60bb203efc659d39b92c2535aec08b4e61bf106543a8d575e562abb35669f9c177ea6b7dda64b6bd7148e414d75e4c1ecc0e3253b
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhy:AylFHUv6ReIt0jSrOG
TLSH
T1B0457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76224.exe

Path C:\Users\Admin\AppData\Local\Temp\76224.exe
Size 1.2MB
SHA256 1c87523182d8f8bf7c2cbd6440b1566a0df96084fde988a87c6202f2c3b093a9
MD5 58a695094822e17caf8542ab076ff5a5
SHA1 67f17d1c11387571e22a92b4f8ee174823aebe8b
SHA512 18d92908ec01f941c7b70ae5f070020bb11454870b82afee2acf6fa01745f76ad191ba021bda90225b391025efd573a2084d10e7912c2cbc648471611745f98c
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh/:AylFHUv6ReIt0jSrO7
TLSH
T14F457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CC75C.exe

Path C:\Users\Admin\AppData\Local\Temp\CC75C.exe
Size 1.2MB
SHA256 d6b008bbe2bd91531f352276d3129d8db02c98fcd00a356bd0ecaf09710d7e77
MD5 886823ec9711ccd799c9091cfc94fb80
SHA1 b2efe73538ac35a3e25f83f422a987243abd1f15
SHA512 8fa79ae5eb4b61a336a72fba43daccb9339c1a0ddc7010f62d51c5088ec3c386121a414adbc435cd4f3ad7f1991eb2e52c5b0d73fcaea7c8c33187f4f01802d5
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhk:AylFHUv6ReIt0jSrOQ
TLSH
T14B457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CT5E8.exe

Path C:\Users\Admin\AppData\Local\Temp\CT5E8.exe
Size 1.2MB
SHA256 ea4755d8fec26cf297c3a43865eeee0e73df31f1da3dc1b9fc1f4074649ba3ff
MD5 46430951bfc94a658a92f995827cd456
SHA1 292dda0a2e0ad897dbd6035031e980ef1f8d1488
SHA512 9b69d3ae95c6ed67d0f8c5dd869088437bb8b3d1f26020dc4d54569e48f77eed386246089abfffca0bfc8718c830b474c5c4ad686f2f7bdb8d17276bb00af7a8
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhm:AylFHUv6ReIt0jSrOC
TLSH
T11F457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D8ZCG.exe

Path C:\Users\Admin\AppData\Local\Temp\D8ZCG.exe
Size 1.2MB
SHA256 dd232df2fe9f2bb996ab1182c16f37eaeb029d1c8fb7b02665701807d9506b4b
MD5 1a19e538c5e2c2ed641870abdd68faef
SHA1 eb34bb538740ab1eef4427dca46e8f8ec841d89a
SHA512 2cba8825368ce3e403ce39cadd6a5d1bedca276a4a2cc357e4e466815863cdf45b4b0cbfc1b7deffc32f638195aafb63be9b1332d0fab46910a1e65252116495
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh0:AylFHUv6ReIt0jSrOw
TLSH
T1D4457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E8U6J.exe

Path C:\Users\Admin\AppData\Local\Temp\E8U6J.exe
Size 1.2MB
SHA256 768c1157ec0744958d2fa4e4b52f8f9b12e4e54197576582bf89c4c9b6754b5f
MD5 9a3354f2671705909a91ff504ce8eb60
SHA1 831efefdec1d0420943dc71a73a51027e9e24a54
SHA512 dda8a60705c728d813400c2d35d1c766065c1ff1ef087f268d456a0fe471a8b28123b4011c37dac8ee74eb34d66838d6ff44b13906508f9078b3c9e3f14ffa5a
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhh:AylFHUv6ReIt0jSrOl
TLSH
T152457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F9691.exe

Path C:\Users\Admin\AppData\Local\Temp\F9691.exe
Size 1.2MB
SHA256 08b6f243b2418dd7e8a316f00c75fb941ca84da301081f94230717f7f29ddc3c
MD5 513dc597f32797b6074c4ac8d640eac2
SHA1 b5815dd05a510ab7a2558307f92a76e78db56155
SHA512 90fbb14f3fe76eb0f1e82cc5659631bd420a6dd5b69470122172a07b3a141d96e1c2bd4e55e8a555155fa772a2a1f9c3d99fa1d146e6e6dbd69f8433c6126a7c
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhH:AylFHUv6ReIt0jSrOT
TLSH
T10B457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GSQU0.exe

Path C:\Users\Admin\AppData\Local\Temp\GSQU0.exe
Size 1.2MB
SHA256 5160bf2a4083ff63541682a64589270581197483eb6c16ec36ad5f5426616b45
MD5 a29273ecc935dc3e058e7d1e46f8f6f1
SHA1 dd09c5f2fa915eba99f1182b17d0a75a2c5c4430
SHA512 d9558194826986371bb21584649e735a185b0f681e4d30c1cdd3651b80ebe6cf262d546c5b62ef0dc1339ae472ac39421433b5936229cc17be80301bec4c9b55
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAht:AylFHUv6ReIt0jSrOZ
TLSH
T1CF457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HL6N8.exe

Path C:\Users\Admin\AppData\Local\Temp\HL6N8.exe
Size 1.2MB
SHA256 d7ec5494b02a31328b35f786292903c090f49389e7d5579dfd7d6c6fa3b37c14
MD5 acb0202b99e8e778d05acc3f0b532ff4
SHA1 240cf64ea84c5e8ea8c1a048c64dd2f26b6b07e8
SHA512 151fc70a987236025c5ddb405ffb7e0b75ff2603edc4ac458c0e51f5a27a7836915a2ca22f7a2ce401eebb8441e6b112e503c65d1509710259c4e604613d7a01
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh6:AylFHUv6ReIt0jSrOG
TLSH
T167457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IFSIC.exe

Path C:\Users\Admin\AppData\Local\Temp\IFSIC.exe
Size 1.2MB
SHA256 6342c7e2383658faaa15634bee89ea6a446426ce9b967c6618f6bff397e65005
MD5 8c9515584db573cd3ed9dd97cd4a5ff7
SHA1 292bf71169e6756b6dab4b43963f35e963989e2d
SHA512 5b4a6c5a286bae95056f7ff5b79da60cc0623cdee3e5b81a433733e26c25719ac2d2f0f4260a4cc903e8c89f2d98637522872e2e4742f451bdf725f2f5b0fb6c
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh9:AylFHUv6ReIt0jSrOp
TLSH
T18A457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IYK40.exe

Path C:\Users\Admin\AppData\Local\Temp\IYK40.exe
Size 1.2MB
SHA256 c9311a7a728ccc86c785f82d6ad9a40f53a714872f8c1aa601e5765dc6ea64ec
MD5 3faa90aecb63c3b9cfa5ceb8e7d36ecb
SHA1 9bc855d42575667666abbb49d14cd38dc38fc186
SHA512 7531c582adae16ccb5fc1c50e3a84a2f8fb7c1fa4a85fd84daf55da064a1a42ef1aeb4876e1c87b97d4a59a5ff173743cbf98d1781a7c6ee1980e29472e46b92
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhJ:AylFHUv6ReIt0jSrO9
TLSH
T105457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

J50XB.exe

Path C:\Users\Admin\AppData\Local\Temp\J50XB.exe
Size 1.2MB
SHA256 69896578d678268bb5d6714d29849774001cf77362765655c0b8a3e64bb3ec56
MD5 a0de4d9fa71988563993ce1563587a2a
SHA1 0b91b8781b496e282e5800b94b54acc252987eea
SHA512 bc1475117cebf767c7055fcc97d28e48f6fcd0a575b947f052d45321df536682da2f04e393be27202bfe8323f4574ed8049ba13a78b215186b5b7ce457f76250
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhE:AylFHUv6ReIt0jSrOI
TLSH
T14C457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LF81E.exe

Path C:\Users\Admin\AppData\Local\Temp\LF81E.exe
Size 1.2MB
SHA256 69deb4d3f769e04c29f394e70c079b98a798bae2c95d6e6b4fd599b8dbaa964d
MD5 7a4be1f1f32b53f478a867d804601cf5
SHA1 f2b9e84b518746732465a2b8601d183f609931c5
SHA512 a662fdb61d6e03918dbd3f34fbf51e937e2c6a1a7a985b67c598e107409f400e7e61f2ec9b6d2b01e8f93e033dc1cf6a3272076434b6c3c86c39cb1836f2304e
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhq:AylFHUv6ReIt0jSrOe
TLSH
T1B9457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PMT78.exe

Path C:\Users\Admin\AppData\Local\Temp\PMT78.exe
Size 1.2MB
SHA256 6839498b849778d74cbdfa8af66d00589d5d111a50e285304e23a3f8cd956a41
MD5 e0dc4608c9c3704b592dcda4dd5cb3af
SHA1 c333e6bfffa6155dd9bad2c3739217c48f70ccae
SHA512 58ebd90755f1979777c2838da6ff02ba3d9c5e049a3048646cd22ae74bb55412dfba9fc0d9b428c2017f0d6ccc9fab9e0959e794dfca93b97fc20bdad2a5b262
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhF:AylFHUv6ReIt0jSrOp
TLSH
T190457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R74KU.exe

Path C:\Users\Admin\AppData\Local\Temp\R74KU.exe
Size 1.2MB
SHA256 55e3bd13d80407eef71cc441aad0b7c380c4de499d2e7986a527f8c825e1df3a
MD5 a9a74a347bf9ea8fb7b1e284e155702e
SHA1 aaa00fe7168f6e7707538a87a0fa16361ab5fb6e
SHA512 067a344702c721aebaa27aa737d29f9016f2f3c9bb6466e900bd247c7521a1a9e79993c873e2edbcd46d1f8c688458de19aa8d39e1cb800e5443ab54897a8b3f
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhq:AylFHUv6ReIt0jSrOO
TLSH
T18A457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B7D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMGF4.exe

Path C:\Users\Admin\AppData\Local\Temp\SMGF4.exe
Size 1.2MB
SHA256 cbbb1de68fa752c562692f73833722366445a02b46c0c04714cc097fa214e337
MD5 d2b19edc9dd2e51b33a1c77307f26185
SHA1 18beb286898761d81b57773dccea12fe5a400c3e
SHA512 46d5ad8cb6badc86956e4f5b20684b5c7c8c7b2937d906a976767c5c51466d216b16683cc8d3829bb58fa7c6d2d472aa247cc713a71968c48f67199d127375a3
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAh5:AylFHUv6ReIt0jSrON
TLSH
T178457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

T15SS.exe

Path C:\Users\Admin\AppData\Local\Temp\T15SS.exe
Size 1.2MB
SHA256 96638d653ff700738b05b4a5aba5dfa25fd949bb9064ffdc198103038536b5bc
MD5 9da58efda3f541e875ad979a99d95ba3
SHA1 9db7fa207766aaa803652d637ff7327e8598712b
SHA512 835b5fd9ac893d3a4a5415ebd4a11ac25d43a82dfbbbcb6eb1c2acbe63a392d7296255cb2216af0ce8dbc641dc91b290476c10354f463207461f11978db5e3a7
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhr:AylFHUv6ReIt0jSrOX
TLSH
T1B4457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

T3155.exe

Path C:\Users\Admin\AppData\Local\Temp\T3155.exe
Size 1.2MB
SHA256 bc9f7e0df3ff26d557190ba48edf0e99fe216ff8b7c1932cc8c9f198293df213
MD5 9d31dd47ecda663253f8111dd110137b
SHA1 83a08818bc151b62f69a1cb346cd1e4f3e877baf
SHA512 0259a9b710253efdcf1e2436dd2009ea4dc7900261da27710da48ff6157517ada9fc7324e2246634ce912a6d90beac316204e5e9999d713c4758597a85bb7a7a
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAho:AylFHUv6ReIt0jSrOU
TLSH
T12D457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

U2GA6.exe

Path C:\Users\Admin\AppData\Local\Temp\U2GA6.exe
Size 1.2MB
SHA256 5d528b74ea99834802aa0edb77b28f441ce39f2ad22fc1218edb457c11a9543b
MD5 5e0d3d06f6280ab26972c337ce43c53a
SHA1 6c1afad648e3fc84a10fd7a883da116fa17a970d
SHA512 4ad56bc73e01bb8b2b12cbf28ec14e48b5970c2cfc693a62700ac11ed85c3fa77fc0a237d727612e5e5ca37eb0ba16762d950b0ee25886ae5fd704d1fe2734d9
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhr:AylFHUv6ReIt0jSrO3
TLSH
T1BF457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V1POB.exe

Path C:\Users\Admin\AppData\Local\Temp\V1POB.exe
Size 1.2MB
SHA256 b7b3b79b0af66ee67c3a23be80b55d36e5f29a586497d01a4c26865563df7ee6
MD5 701f5255b3e042b1e9925e9ea85e93cb
SHA1 bfcc178803d593ec6e5a7ea3cb1a316256d860b1
SHA512 511c28b2ffbd0b7ee37d17156b036db4b15ebd6e30b6361d5d86f17521cdd356964a1283e86f557fa82e273663f4a6b9ddfa6432a8413e68a7acfe05358ee64e
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAht:AylFHUv6ReIt0jSrOR
TLSH
T145457D12765D81B1D19C14702D6F7336A9306A193B32CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XZ32X.exe

Path C:\Users\Admin\AppData\Local\Temp\XZ32X.exe
Size 1.2MB
SHA256 a18fd5c80f8cc77086d6fdf6d68a2a63e9abaddc90b7d4debda58d822ade57a4
MD5 4525cf4b41b37010e49022b856c42d0b
SHA1 53a9ed0823e62f2dd6f3534b7177770d1d030772
SHA512 3a1bbe3f5bb7150b5af72075160e9ef6561b4b3bd3e8ec9365f85c744274b4363bdf53832f84aa5e55dfd7bb104e8f1d83d8c0617a74f1d0d97d74e29506e75f
SSDEEP 24576:NqylFH50Dv6RwyeQvt6ot0h9HyrOgiruAMnnAhJ:AylFHUv6ReIt0jSrOt
TLSH
T1C5457D12765D81B1D19C14702D6F7336A9306A193B36CEE3B3D2DD789E32BD1AE36209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-712-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4620-496-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/5000-0-0x0000000000400000-0x0000000000530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads