hawkeye | 77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
Size

468KB
MD5

6ccf841ca92807fe9f10db607f137e69
SHA1

3bc2018b7bb88980b99f1c6f0d8e6ef1392a1072
SHA256

77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727
SHA512

0be1c72156629eb95874fafce4928dd0deb2c17fc181efa1be3d8895985f9ecf972cb2af88f7a68ad8851b3c245b26f46701dcaf368f5aea81a882bbf2b5fc40
SSDEEP

12288:jQFHduFTvmOaeFE0+52UXcQJeR7M+tBkXHh:jQdE1NFE045M9ZAHh

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
gud12345678

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 9 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2836-11-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/2836-19-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/2836-21-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/2836-17-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/2836-13-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/796-37-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/796-38-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/796-43-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1984-105-0x0000000000080000-0x0000000000104000-memory.dmp	Nirsoft

NirSoft MailPassView 9 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2836-11-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/2836-19-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/2836-21-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/2836-17-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/2836-13-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/796-37-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/796-38-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/796-43-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1984-105-0x0000000000080000-0x0000000000104000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2836-11-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/2836-19-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/2836-21-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/2836-17-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/2836-13-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1984-105-0x0000000000080000-0x0000000000104000-memory.dmp	WebBrowserPassView

Executes dropped EXE 64 IoCs

pid	Process
2804	IpOverUsbSvrc.exe
2012	atiesrx.exe
2980	atiesrx.exe
2296	IpOverUsbSvrc.exe
444	atiesrx.exe
1080	atiesrx.exe
1984	atiesrx.exe
2068	atiesrx.exe
876	atiesrx.exe
1028	atiesrx.exe
2404	atiesrx.exe
2828	atiesrx.exe
1644	atiesrx.exe
1980	atiesrx.exe
2960	atiesrx.exe
3064	atiesrx.exe
2344	atiesrx.exe
2244	atiesrx.exe
864	atiesrx.exe
884	atiesrx.exe
2452	atiesrx.exe
1668	atiesrx.exe
2100	atiesrx.exe
2776	atiesrx.exe
2664	atiesrx.exe
2764	atiesrx.exe
1764	atiesrx.exe
2900	atiesrx.exe
3056	atiesrx.exe
2348	atiesrx.exe
1720	atiesrx.exe
2192	atiesrx.exe
2260	atiesrx.exe
2376	atiesrx.exe
348	atiesrx.exe
2864	atiesrx.exe
2460	atiesrx.exe
1716	atiesrx.exe
2512	atiesrx.exe
2116	atiesrx.exe
1800	atiesrx.exe
612	atiesrx.exe
760	atiesrx.exe
2264	atiesrx.exe
2576	atiesrx.exe
2800	atiesrx.exe
2136	atiesrx.exe
1396	atiesrx.exe
2380	atiesrx.exe
2112	atiesrx.exe
1084	atiesrx.exe
2964	atiesrx.exe
3032	atiesrx.exe
788	atiesrx.exe
2064	atiesrx.exe
2992	atiesrx.exe
1936	atiesrx.exe
856	atiesrx.exe
1620	atiesrx.exe
1232	atiesrx.exe
2472	atiesrx.exe
1556	atiesrx.exe
3012	atiesrx.exe
1712	atiesrx.exe

Loads dropped DLL 3 IoCs

pid	Process
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2804	IpOverUsbSvrc.exe
2012	atiesrx.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyipaddress.com

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2836 set thread context of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2012 set thread context of 2980	2012	atiesrx.exe	36
PID 2012 set thread context of 444	2012	atiesrx.exe	38
PID 2012 set thread context of 1080	2012	atiesrx.exe	39
PID 2012 set thread context of 1984	2012	atiesrx.exe	40
PID 2012 set thread context of 2068	2012	atiesrx.exe	41
PID 2012 set thread context of 876	2012	atiesrx.exe	42
PID 2012 set thread context of 1028	2012	atiesrx.exe	43
PID 2012 set thread context of 2404	2012	atiesrx.exe	44
PID 2012 set thread context of 2828	2012	atiesrx.exe	45
PID 2012 set thread context of 1644	2012	atiesrx.exe	46
PID 2012 set thread context of 1980	2012	atiesrx.exe	47
PID 2012 set thread context of 2960	2012	atiesrx.exe	48
PID 2012 set thread context of 3064	2012	atiesrx.exe	49
PID 2012 set thread context of 2344	2012	atiesrx.exe	50
PID 2012 set thread context of 2244	2012	atiesrx.exe	51
PID 2012 set thread context of 864	2012	atiesrx.exe	52
PID 2012 set thread context of 884	2012	atiesrx.exe	53
PID 2012 set thread context of 2452	2012	atiesrx.exe	54
PID 2012 set thread context of 1668	2012	atiesrx.exe	55
PID 2012 set thread context of 2100	2012	atiesrx.exe	56
PID 2012 set thread context of 2776	2012	atiesrx.exe	57
PID 2012 set thread context of 2664	2012	atiesrx.exe	58
PID 2012 set thread context of 2764	2012	atiesrx.exe	59
PID 2012 set thread context of 1764	2012	atiesrx.exe	60
PID 2012 set thread context of 2900	2012	atiesrx.exe	61
PID 2012 set thread context of 3056	2012	atiesrx.exe	62
PID 2012 set thread context of 2348	2012	atiesrx.exe	63
PID 2012 set thread context of 1720	2012	atiesrx.exe	64
PID 2012 set thread context of 2192	2012	atiesrx.exe	65
PID 2012 set thread context of 2260	2012	atiesrx.exe	66
PID 2012 set thread context of 2376	2012	atiesrx.exe	67
PID 2012 set thread context of 348	2012	atiesrx.exe	68
PID 2012 set thread context of 2864	2012	atiesrx.exe	69
PID 2012 set thread context of 2460	2012	atiesrx.exe	70
PID 2012 set thread context of 1716	2012	atiesrx.exe	71
PID 2012 set thread context of 2512	2012	atiesrx.exe	72
PID 2012 set thread context of 2116	2012	atiesrx.exe	73
PID 2012 set thread context of 1800	2012	atiesrx.exe	74
PID 2012 set thread context of 612	2012	atiesrx.exe	75
PID 2012 set thread context of 760	2012	atiesrx.exe	76
PID 2012 set thread context of 2264	2012	atiesrx.exe	77
PID 2012 set thread context of 2576	2012	atiesrx.exe	78
PID 2012 set thread context of 2800	2012	atiesrx.exe	79
PID 2012 set thread context of 2136	2012	atiesrx.exe	80
PID 2012 set thread context of 1396	2012	atiesrx.exe	81
PID 2012 set thread context of 2380	2012	atiesrx.exe	82
PID 2012 set thread context of 2112	2012	atiesrx.exe	83
PID 2012 set thread context of 1084	2012	atiesrx.exe	84
PID 2012 set thread context of 2964	2012	atiesrx.exe	85
PID 2012 set thread context of 3032	2012	atiesrx.exe	86
PID 2012 set thread context of 788	2012	atiesrx.exe	87
PID 2012 set thread context of 2064	2012	atiesrx.exe	88
PID 2012 set thread context of 2992	2012	atiesrx.exe	89
PID 2012 set thread context of 1936	2012	atiesrx.exe	90
PID 2012 set thread context of 856	2012	atiesrx.exe	91
PID 2012 set thread context of 1620	2012	atiesrx.exe	92
PID 2012 set thread context of 1232	2012	atiesrx.exe	93
PID 2012 set thread context of 2472	2012	atiesrx.exe	94
PID 2012 set thread context of 1556	2012	atiesrx.exe	95
PID 2012 set thread context of 3012	2012	atiesrx.exe	96
PID 2012 set thread context of 1712	2012	atiesrx.exe	97
PID 2012 set thread context of 2108	2012	atiesrx.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atiesrx.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
Token: SeDebugPrivilege	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
Token: SeDebugPrivilege	2804	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	2012	atiesrx.exe
Token: SeDebugPrivilege	2296	IpOverUsbSvrc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2836	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	31
PID 2556 wrote to memory of 2804	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	32
PID 2556 wrote to memory of 2804	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	32
PID 2556 wrote to memory of 2804	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	32
PID 2556 wrote to memory of 2804	2556	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	32
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2836 wrote to memory of 796	2836	77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe	34
PID 2804 wrote to memory of 2012	2804	IpOverUsbSvrc.exe	35
PID 2804 wrote to memory of 2012	2804	IpOverUsbSvrc.exe	35
PID 2804 wrote to memory of 2012	2804	IpOverUsbSvrc.exe	35
PID 2804 wrote to memory of 2012	2804	IpOverUsbSvrc.exe	35
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2980	2012	atiesrx.exe	36
PID 2012 wrote to memory of 2296	2012	atiesrx.exe	37
PID 2012 wrote to memory of 2296	2012	atiesrx.exe	37
PID 2012 wrote to memory of 2296	2012	atiesrx.exe	37
PID 2012 wrote to memory of 2296	2012	atiesrx.exe	37
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 444	2012	atiesrx.exe	38
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1080	2012	atiesrx.exe	39
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40
PID 2012 wrote to memory of 1984	2012	atiesrx.exe	40

C:\Users\Admin\AppData\Local\Temp\77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
"C:\Users\Admin\AppData\Local\Temp\77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe
  "C:\Users\Admin\AppData\Local\Temp\77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:796
- C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2980
  - - C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:444
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1080
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1028
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1644
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1980
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:3064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2344
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2244
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:864
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:884
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2776
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2764
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:3056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2348
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2192
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2260
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2376
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:348
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2864
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1716
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2512
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1800
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2264
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2800
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2136
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1396
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2380
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:3032
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:788
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:2992
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1936
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:856
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1620
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1232
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:3012
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2668
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1604
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1304
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1872
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:340
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2808
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1952
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1048
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1368
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2744
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1856
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1584
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:320
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:584
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1832
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2384
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:528
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:844
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3124
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1524
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3604
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3924
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4864
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4296
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:764
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6180
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6456
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6640
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6732
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6920
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6216
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6440
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6944
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6848
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6488
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6672
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6872
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7160
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6476
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6624
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6888
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6224
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6536
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6896
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6584
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6320
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6712
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6716
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6424
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6376
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7148
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6912
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7032
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6516
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6304
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7588
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7684
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7764
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7528
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7680
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7180
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7272
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7384
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7468
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7692
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7640
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7908
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7424
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7936
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7488
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7836
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
      4⤵
      PID:7716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe

Filesize
7KB

MD5
7e50c731e4fcaac9f395aa1faae07674

SHA1
4e347ae9b63a0d7d920e5f7a913825a2504b251c

SHA256
218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70

SHA512
397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
468KB

MD5
6ccf841ca92807fe9f10db607f137e69

SHA1
3bc2018b7bb88980b99f1c6f0d8e6ef1392a1072

SHA256
77b2b3c5aba9047e063097d6a0e5efa617e539df5630404a81b4437cd7b0b727

SHA512
0be1c72156629eb95874fafce4928dd0deb2c17fc181efa1be3d8895985f9ecf972cb2af88f7a68ad8851b3c245b26f46701dcaf368f5aea81a882bbf2b5fc40

Download Submit
memory/444-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/796-43-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/796-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/796-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1984-105-0x0000000000080000-0x0000000000104000-memory.dmp

Filesize
528KB

Download
memory/2556-4-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-3-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-47-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-2-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-1-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-0-0x0000000074371000-0x0000000074372000-memory.dmp

Filesize
4KB

Download
memory/2556-36-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-42-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-31-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-48-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-41-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-23-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-21-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-22-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-40-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-39-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-13-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-17-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-24-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-19-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-9-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2836-7-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2836-11-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2980-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download