12e067c7cae21f1521aded63f6e0649e4fb81d8f19eebb476e248146dffd2865

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_93466a82efd30614c07c7296f72e83b1_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260705-brastabx7l
SHA256 12e067c7cae21f1521aded63f6e0649e4fb81d8f19eebb476e248146dffd2865
MD5 93466a82efd30614c07c7296f72e83b1
SHA1 d42df9ee584a192261fdde70a65c84b172a208f4
SHA512 c45fe683d682b7685537792054e34c4fdb2d74b346ae9d856ff4d7564244db52af9dac3c8f902bcb6826798e5bc07d69bbd4ac2bbae7eb486e07aee30e511c10
SSDEEP 49152:w/OJDrtbIgg6pNGEADt7i+/yTukuFGNLrkBirx:EOzguchrSiGdkBirx
TLSH
T11C06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1432	CCC1.tmp
1228	CF70.tmp
1820	D0E7.tmp
1136	D4C0.tmp
5852	D5F8.tmp
2152	D6C3.tmp
692	DCAF.tmp
6072	DF8D.tmp
3896	E23D.tmp
5016	E4EC.tmp
4504	E77D.tmp
3968	E9EE.tmp
2672	EC9D.tmp
5880	EF6C.tmp
5020	F1FC.tmp
2852	F46D.tmp
3908	F6FD.tmp
1156	F9CC.tmp
5976	FCE9.tmp
4528	54.tmp
1560	1AC.tmp
2024	546.tmp
5988	843.tmp
260	B02.tmp
1772	DD1.tmp
796	10A0.tmp
856	1311.tmp
1200	15C0.tmp
5912	188F.tmp
4888	1AE1.tmp
2388	1D90.tmp
5436	2021.tmp
4076	22E0.tmp
4248	23E9.tmp
1288	24F3.tmp
4492	25DD.tmp
5760	2716.tmp
4192	2800.tmp
1768	291A.tmp
3256	2A14.tmp
5780	2B1D.tmp
4284	2BD9.tmp
5656	2CD3.tmp
2072	2E1B.tmp
6008	2F24.tmp
6048	303E.tmp
4696	3147.tmp
2800	32CE.tmp
3244	3399.tmp
4484	3455.tmp
1256	3520.tmp
1464	35EB.tmp
2952	36A6.tmp
1144	3781.tmp
1528	384C.tmp
5748	3917.tmp
5060	39F2.tmp
2108	3ACD.tmp
3520	3BA8.tmp
1660	3C73.tmp
5932	3D3E.tmp
4964	3E19.tmp
2968	3EF3.tmp
2544	3FDE.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	709D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8195.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9368.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96B3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10A0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D44E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56CC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AB74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	963.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	188F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AEF3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCC5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4528.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF70.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5F8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B0D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C990.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA4B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4AE5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DDCE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F071.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	905A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6226.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1FC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6CF9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EAA4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	754.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23D5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AE43.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC48.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8A1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4C4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C41.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14AD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E545.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2481.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EC0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45D4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B888.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	617F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A961.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F0E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76BD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A59D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9125.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C15D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F5DB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D6F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B51D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB07.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F459.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB4E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C58.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87FE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EA32.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E6B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BAEA.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1432	4164	2026-07-05_93466a82efd30614c07c7296f72e83b1_elex_mafia_poet-rat_stealc_tofsee.exe	88
PID 1432 wrote to memory of 1228	1432	CCC1.tmp	89
PID 1228 wrote to memory of 1820	1228	CF70.tmp	90
PID 1820 wrote to memory of 1136	1820	D0E7.tmp	91
PID 1136 wrote to memory of 5852	1136	D4C0.tmp	92
PID 5852 wrote to memory of 2152	5852	D5F8.tmp	93
PID 2152 wrote to memory of 692	2152	D6C3.tmp	94
PID 692 wrote to memory of 6072	692	DCAF.tmp	95
PID 6072 wrote to memory of 3896	6072	DF8D.tmp	96
PID 3896 wrote to memory of 5016	3896	E23D.tmp	97
PID 5016 wrote to memory of 4504	5016	E4EC.tmp	98
PID 4504 wrote to memory of 3968	4504	E77D.tmp	99
PID 3968 wrote to memory of 2672	3968	E9EE.tmp	100
PID 2672 wrote to memory of 5880	2672	EC9D.tmp	101
PID 5880 wrote to memory of 5020	5880	EF6C.tmp	102
PID 5020 wrote to memory of 2852	5020	F1FC.tmp	103
PID 2852 wrote to memory of 3908	2852	F46D.tmp	104
PID 3908 wrote to memory of 1156	3908	F6FD.tmp	105
PID 1156 wrote to memory of 5976	1156	F9CC.tmp	106
PID 5976 wrote to memory of 4528	5976	FCE9.tmp	107
PID 4528 wrote to memory of 1560	4528	54.tmp	108
PID 1560 wrote to memory of 2024	1560	1AC.tmp	109
PID 2024 wrote to memory of 5988	2024	546.tmp	110
PID 5988 wrote to memory of 260	5988	843.tmp	111
PID 260 wrote to memory of 1772	260	B02.tmp	112
PID 1772 wrote to memory of 796	1772	DD1.tmp	113
PID 796 wrote to memory of 856	796	10A0.tmp	114
PID 856 wrote to memory of 1200	856	1311.tmp	115
PID 1200 wrote to memory of 5912	1200	15C0.tmp	116
PID 5912 wrote to memory of 4888	5912	188F.tmp	117
PID 4888 wrote to memory of 2388	4888	1AE1.tmp	118
PID 2388 wrote to memory of 5436	2388	1D90.tmp	119
PID 5436 wrote to memory of 4076	5436	2021.tmp	120
PID 4076 wrote to memory of 4248	4076	22E0.tmp	121
PID 4248 wrote to memory of 1288	4248	23E9.tmp	122
PID 1288 wrote to memory of 4492	1288	24F3.tmp	123
PID 4492 wrote to memory of 5760	4492	25DD.tmp	124
PID 5760 wrote to memory of 4192	5760	2716.tmp	125
PID 4192 wrote to memory of 1768	4192	2800.tmp	126
PID 1768 wrote to memory of 3256	1768	291A.tmp	127
PID 3256 wrote to memory of 5780	3256	2A14.tmp	128
PID 5780 wrote to memory of 4284	5780	2B1D.tmp	129
PID 4284 wrote to memory of 5656	4284	2BD9.tmp	130
PID 5656 wrote to memory of 2072	5656	2CD3.tmp	131
PID 2072 wrote to memory of 6008	2072	2E1B.tmp	132
PID 6008 wrote to memory of 6048	6008	2F24.tmp	133
PID 6048 wrote to memory of 4696	6048	303E.tmp	134
PID 4696 wrote to memory of 2800	4696	3147.tmp	135
PID 2800 wrote to memory of 3244	2800	32CE.tmp	136
PID 3244 wrote to memory of 4484	3244	3399.tmp	137
PID 4484 wrote to memory of 1256	4484	3455.tmp	138
PID 1256 wrote to memory of 1464	1256	3520.tmp	139
PID 1464 wrote to memory of 2952	1464	35EB.tmp	140
PID 2952 wrote to memory of 1144	2952	36A6.tmp	141
PID 1144 wrote to memory of 1528	1144	3781.tmp	142
PID 1528 wrote to memory of 5748	1528	384C.tmp	143
PID 5748 wrote to memory of 5060	5748	3917.tmp	144
PID 5060 wrote to memory of 2108	5060	39F2.tmp	145
PID 2108 wrote to memory of 3520	2108	3ACD.tmp	146
PID 3520 wrote to memory of 1660	3520	3BA8.tmp	147
PID 1660 wrote to memory of 5932	1660	3C73.tmp	148
PID 5932 wrote to memory of 4964	5932	3D3E.tmp	149
PID 4964 wrote to memory of 2968	4964	3E19.tmp	150
PID 2968 wrote to memory of 2544	2968	3EF3.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-07-05_93466a82efd30614c07c7296f72e83b1_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_93466a82efd30614c07c7296f72e83b1_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\CCC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\CF70.tmp
    "C:\Users\Admin\AppData\Local\Temp\CF70.tmp"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\D0E7.tmp
      "C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\D4C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\D5F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\D6C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\DCAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\DF8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\E23D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E23D.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\E4EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\E77D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E77D.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\E9EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\EC9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\EF6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\F1FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\F46D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F46D.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\F6FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\F9CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\FCE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCE9.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\1AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AC.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\546.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\546.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\843.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\B02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B02.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\DD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD1.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\10A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10A0.tmp"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\1311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1311.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\15C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15C0.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\188F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\188F.tmp"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\1AE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\1D90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D90.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\2021.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2021.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\22E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22E0.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\23E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23E9.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\24F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24F3.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\25DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25DD.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\2716.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2716.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\2800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2800.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\291A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291A.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\2A14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A14.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\2B1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\2BD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\2CD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\2E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\2F24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F24.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\303E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\303E.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\3147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3147.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\32CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32CE.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\3399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3399.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\3455.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3455.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\3520.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3520.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\35EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35EB.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\36A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36A6.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\3781.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3781.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\384C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\384C.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\3917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3917.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\39F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39F2.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\3ACD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\3BA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\3C73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C73.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\3D3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\3E19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E19.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\3EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\3FDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"
        65⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\40C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40C8.tmp"
        66⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\41A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41A3.tmp"
        67⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\425E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\425E.tmp"
        68⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\4329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4329.tmp"
        69⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\43F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43F5.tmp"
        70⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\44DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44DF.tmp"
        71⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\459A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\459A.tmp"
        72⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\4675.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4675.tmp"
        73⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\4731.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4731.tmp"
        74⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\47EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47EC.tmp"
        75⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\48B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48B7.tmp"
        76⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\4992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4992.tmp"
        77⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\4A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"
        78⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\4B38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B38.tmp"
        79⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\4C13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C13.tmp"
        80⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\4CCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"
        81⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\4D7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"
        82⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\4E26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E26.tmp"
        83⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\4ED2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"
        84⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\4F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"
        85⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\5049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5049.tmp"
        86⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\5133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5133.tmp"
        87⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\51CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51CF.tmp"
        88⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\529B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\529B.tmp"
        89⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\5356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5356.tmp"
        90⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\5431.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5431.tmp"
        91⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\550C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\550C.tmp"
        92⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\55D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55D7.tmp"
        93⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\5692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5692.tmp"
        94⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\575D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\575D.tmp"
        95⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\5819.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5819.tmp"
        96⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\58E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58E4.tmp"
        97⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\59AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59AF.tmp"
        98⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\5A8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"
        99⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\5B45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B45.tmp"
        100⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\5C20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C20.tmp"
        101⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\5CDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"
        102⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\5D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D97.tmp"
        103⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\5E62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E62.tmp"
        104⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\5F0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\5FE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"
        106⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\60B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60B4.tmp"
        107⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\617F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617F.tmp"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\625A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\625A.tmp"
        109⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\6335.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6335.tmp"
        110⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\642F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\642F.tmp"
        111⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\64EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64EA.tmp"
        112⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\65C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65C5.tmp"
        113⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\6671.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6671.tmp"
        114⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\675B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\675B.tmp"
        115⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\6826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6826.tmp"
        116⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\68D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68D2.tmp"
        117⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\69BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69BC.tmp"
        118⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\6A78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A78.tmp"
        119⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\6B53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B53.tmp"
        120⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\6C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"
        121⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\6CF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\6DB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"
        123⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\6E7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"
        124⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\6F3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"
        125⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\7006.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7006.tmp"
        126⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\70C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70C1.tmp"
        127⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\717D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\717D.tmp"
        128⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\7238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7238.tmp"
        129⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\7303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7303.tmp"
        130⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\73CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73CF.tmp"
        131⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\746B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\746B.tmp"
        132⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\7546.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7546.tmp"
        133⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\7601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7601.tmp"
        134⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\76BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76BD.tmp"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\77B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77B7.tmp"
        136⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\7872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7872.tmp"
        137⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\792E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\792E.tmp"
        138⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\79F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79F9.tmp"
        139⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\7B02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B02.tmp"
        140⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\7BAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"
        141⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\7C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C79.tmp"
        142⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\7D16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D16.tmp"
        143⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\7DF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"
        144⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\7EDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"
        145⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\7F96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F96.tmp"
        146⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\8052.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8052.tmp"
        147⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\813C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\813C.tmp"
        148⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\8207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8207.tmp"
        149⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\82D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82D2.tmp"
        150⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\83EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83EC.tmp"
        151⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\8497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8497.tmp"
        152⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\8572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8572.tmp"
        153⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\865D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\865D.tmp"
        154⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\8708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8708.tmp"
        155⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\87C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87C4.tmp"
        156⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\888F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\888F.tmp"
        157⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\895A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\895A.tmp"
        158⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\8A25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A25.tmp"
        159⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\8AE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"
        160⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\8BCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"
        161⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\8C96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C96.tmp"
        162⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\8D61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D61.tmp"
        163⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\8E6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\8F46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F46.tmp"
        165⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\9011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9011.tmp"
        166⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\90DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90DC.tmp"
        167⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\9198.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9198.tmp"
        168⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\9272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9272.tmp"
        169⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\931E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\931E.tmp"
        170⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\93E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E9.tmp"
        171⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\94C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94C4.tmp"
        172⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\958F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\958F.tmp"
        173⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\965A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\965A.tmp"
        174⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\9735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9735.tmp"
        175⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\97E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97E1.tmp"
        176⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\98BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98BC.tmp"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\9996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9996.tmp"
        178⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\9A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A52.tmp"
        179⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\9B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\9BB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"
        181⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\9CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"
        182⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\9D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\9E3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"
        184⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\9EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"
        185⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\9FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"
        186⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\A0BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"
        187⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\A1A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"
        188⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\A260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A260.tmp"
        189⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\A33B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A33B.tmp"
        190⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\A406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A406.tmp"
        191⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\A4D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"
        192⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\A59D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A59D.tmp"
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\A687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A687.tmp"
        194⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\A752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A752.tmp"
        195⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\A85C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A85C.tmp"
        196⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\A927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A927.tmp"
        197⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\AA02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA02.tmp"
        198⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\AADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AADC.tmp"
        199⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\ABA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"
        200⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\AC92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC92.tmp"
        201⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\AD4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"
        202⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\AE18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE18.tmp"
        203⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\AEF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\AFAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"
        205⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\B05B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B05B.tmp"
        206⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\B145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B145.tmp"
        207⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\B23F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B23F.tmp"
        208⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\B2FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"
        209⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\B3B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"
        210⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\B481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B481.tmp"
        211⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\B51D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B51D.tmp"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\B5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"
        213⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\B6F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"
        214⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\B7AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"
        215⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\B888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B888.tmp"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\B944.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B944.tmp"
        217⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\BA1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"
        218⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\BAEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\BBD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"
        220⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\BC9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"
        221⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\BD99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD99.tmp"
        222⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\BE55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE55.tmp"
        223⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\BF20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF20.tmp"
        224⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\BFEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"
        225⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\C0C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"
        226⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\C181.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C181.tmp"
        227⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\C23D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C23D.tmp"
        228⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\C337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C337.tmp"
        229⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\C402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C402.tmp"
        230⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\C4BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"
        231⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\C588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C588.tmp"
        232⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\C654.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C654.tmp"
        233⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\C70F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70F.tmp"
        234⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\C7EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"
        235⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\C8B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"
        236⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\C990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C990.tmp"
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\CA4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\CB07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB07.tmp"
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\CBE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"
        240⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\CC7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"
        241⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\CD49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD49.tmp"
        242⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\CE24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE24.tmp"
        243⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\CEDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"
        244⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\CF9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"
        245⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\D075.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D075.tmp"
        246⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\D150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D150.tmp"
        247⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\D20C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D20C.tmp"
        248⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\D2D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"
        249⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\D3A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"
        250⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\D44E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D44E.tmp"
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\D538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D538.tmp"
        252⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\D5F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"
        253⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\D6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"
        254⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\D78A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D78A.tmp"
        255⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\D845.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D845.tmp"
        256⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\D910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D910.tmp"
        257⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\D9EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"
        258⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\DAE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"
        259⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\DBA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"
        260⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\DC8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"
        261⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\DD75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD75.tmp"
        262⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\DE31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE31.tmp"
        263⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\DF0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF0C.tmp"
        264⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\DFC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"
        265⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\E092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E092.tmp"
        266⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\E16D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E16D.tmp"
        267⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\E238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E238.tmp"
        268⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\E2F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"
        269⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\E3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"
        270⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\E48A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E48A.tmp"
        271⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\E545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E545.tmp"
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\E601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E601.tmp"
        273⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\E6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"
        274⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\E7A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"
        275⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\E862.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E862.tmp"
        276⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\E93D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E93D.tmp"
        277⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\E9E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"
        278⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\EAA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\EB60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB60.tmp"
        280⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\EC79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC79.tmp"
        281⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\ED35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED35.tmp"
        282⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\EDF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"
        283⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\EECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EECB.tmp"
        284⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\EFA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"
        285⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\F071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F071.tmp"
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\F13C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F13C.tmp"
        287⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\F1E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"
        288⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\F2B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2B3.tmp"
        289⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\F36E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F36E.tmp"
        290⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\F459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F459.tmp"
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\F505.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F505.tmp"
        292⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\F62E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F62E.tmp"
        293⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\F6CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"
        294⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\F795.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F795.tmp"
        295⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\F860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F860.tmp"
        296⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\F90C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F90C.tmp"
        297⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\F9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"
        298⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\FA73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA73.tmp"
        299⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\FB4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"
        300⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\FC19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC19.tmp"
        301⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\FCC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\FD90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD90.tmp"
        303⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\FE6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"
        304⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\FF46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF46.tmp"
        305⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\FFE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"
        306⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD.tmp"
        307⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\169.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\169.tmp"
        308⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\224.tmp"
        309⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\2D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D0.tmp"
        310⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\38B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38B.tmp"
        311⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\457.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\457.tmp"
        312⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\502.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\502.tmp"
        313⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\59F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F.tmp"
        314⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\679.tmp"
        315⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\754.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\754.tmp"
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800.tmp"
        317⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC.tmp"
        318⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\967.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\967.tmp"
        319⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\A23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A23.tmp"
        320⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\ADE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADE.tmp"
        321⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\BAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAA.tmp"
        322⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\C84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C84.tmp"
        323⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\D4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4F.tmp"
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\E0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0B.tmp"
        325⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF5.tmp"
        326⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA1.tmp"
        327⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\103D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\103D.tmp"
        328⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\1109.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1109.tmp"
        329⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\11C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11C4.tmp"
        330⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\1280.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1280.tmp"
        331⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\133B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\133B.tmp"
        332⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\1416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1416.tmp"
        333⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\1500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1500.tmp"
        334⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\15BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15BC.tmp"
        335⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\1668.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1668.tmp"
        336⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\1713.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1713.tmp"
        337⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\17FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17FE.tmp"
        338⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\18AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18AA.tmp"
        339⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\1956.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1956.tmp"
        340⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\1A21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A21.tmp"
        341⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\1ADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"
        342⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\1BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"
        343⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\1C72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C72.tmp"
        344⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\1D3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"
        345⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\1DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"
        346⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\1EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"
        347⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\1F60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F60.tmp"
        348⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\202C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\202C.tmp"
        349⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\20D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20D7.tmp"
        350⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\2193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2193.tmp"
        351⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\225E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\225E.tmp"
        352⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\2329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2329.tmp"
        353⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\23D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D5.tmp"
        354⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\2481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2481.tmp"
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\253C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\253C.tmp"
        356⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\25F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F8.tmp"
        357⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\26D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26D3.tmp"
        358⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\277F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\277F.tmp"
        359⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\281B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\281B.tmp"
        360⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\2905.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2905.tmp"
        361⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\29D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29D0.tmp"
        362⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\2A8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"
        363⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\2B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B47.tmp"
        364⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\2C12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C12.tmp"
        365⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\2CDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"
        366⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\2DB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"
        367⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\2E74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E74.tmp"
        368⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\2F2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"
        369⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\2FDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"
        370⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\30A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30A6.tmp"
        371⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\3162.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3162.tmp"
        372⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\323D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\323D.tmp"
        373⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\32D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32D9.tmp"
        374⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\3394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3394.tmp"
        375⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\3450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3450.tmp"
        376⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\350B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\350B.tmp"
        377⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\35E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35E6.tmp"
        378⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\36C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36C1.tmp"
        379⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\376D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\376D.tmp"
        380⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\3838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3838.tmp"
        381⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\3913.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3913.tmp"
        382⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\39BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39BE.tmp"
        383⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\3A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"
        384⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\3B35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B35.tmp"
        385⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\3BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"
        386⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\3CAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CAC.tmp"
        387⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\3D68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D68.tmp"
        388⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\3E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E14.tmp"
        389⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\3EC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EC0.tmp"
        390⤵
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\3F7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"
        391⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\4046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4046.tmp"
        392⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\40E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40E3.tmp"
        393⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\419E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\419E.tmp"
        394⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\425A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\425A.tmp"
        395⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\4305.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4305.tmp"
        396⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\43D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43D1.tmp"
        397⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\446D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\446D.tmp"
        398⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\4528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4528.tmp"
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\45D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45D4.tmp"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\4690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4690.tmp"
        401⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\474B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\474B.tmp"
        402⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\4816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4816.tmp"
        403⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\48B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48B3.tmp"
        404⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\497E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\497E.tmp"
        405⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\4A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A58.tmp"
        406⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\4AE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\4B91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B91.tmp"
        408⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\4C4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"
        409⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\4D08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D08.tmp"
        410⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\4DC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DC3.tmp"
        411⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\4E7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"
        412⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\4F3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"
        413⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\4FF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"
        414⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\50B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50B1.tmp"
        415⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\515D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\515D.tmp"
        416⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\5248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5248.tmp"
        417⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\52F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52F4.tmp"
        418⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\53CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53CE.tmp"
        419⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\5499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5499.tmp"
        420⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\5545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5545.tmp"
        421⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\5620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5620.tmp"
        422⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\56CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56CC.tmp"
        423⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\5768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5768.tmp"
        424⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\5814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5814.tmp"
        425⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\58D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58D0.tmp"
        426⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\599B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\599B.tmp"
        427⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\5A75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A75.tmp"
        428⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\5B21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B21.tmp"
        429⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\5BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"
        430⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\5CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"
        431⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\5D54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D54.tmp"
        432⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\5E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"
        433⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\5EEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"
        434⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\5FD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FD4.tmp"
        435⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\6090.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6090.tmp"
        436⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\616B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\616B.tmp"
        437⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\6226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6226.tmp"
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\62D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62D2.tmp"
        439⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\63BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63BC.tmp"
        440⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\6468.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6468.tmp"
        441⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\6533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6533.tmp"
        442⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\65EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65EF.tmp"
        443⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\669B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\669B.tmp"
        444⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\6756.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6756.tmp"
        445⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\6821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6821.tmp"
        446⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\68BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68BE.tmp"
        447⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\6989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6989.tmp"
        448⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\6A44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A44.tmp"
        449⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\6AF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"
        450⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\6B8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B8C.tmp"
        451⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\6C58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C58.tmp"
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\6D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D03.tmp"
        453⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\6DAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DAF.tmp"
        454⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\6E7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E7A.tmp"
        455⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\6F26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F26.tmp"
        456⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\6FD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"
        457⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\709D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\709D.tmp"
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\713A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\713A.tmp"
        459⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\71F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71F5.tmp"
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\72C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72C0.tmp"
        461⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\738B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\738B.tmp"
        462⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\7428.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7428.tmp"
        463⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\74E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74E3.tmp"
        464⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\758F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\758F.tmp"
        465⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\762B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\762B.tmp"
        466⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\7ABF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7ABF.tmp"
        467⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\7B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"
        468⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\7C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C36.tmp"
        469⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\7D20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D20.tmp"
        470⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\7DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"
        471⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\7EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"
        472⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\7F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F63.tmp"
        473⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\800E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800E.tmp"
        474⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\80CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80CA.tmp"
        475⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\8195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8195.tmp"
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\8231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8231.tmp"
        477⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\82ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82ED.tmp"
        478⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\8399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8399.tmp"
        479⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\8454.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8454.tmp"
        480⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\8510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8510.tmp"
        481⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\85BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85BC.tmp"
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\8658.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8658.tmp"
        483⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\8723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8723.tmp"
        484⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\87FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87FE.tmp"
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\88AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88AA.tmp"
        486⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\8965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8965.tmp"
        487⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\8A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A30.tmp"
        488⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\8AEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"
        489⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\8BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"
        490⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\8C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C63.tmp"
        491⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\8D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"
        492⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\8DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DF9.tmp"
        493⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\8EB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"
        494⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\8F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F80.tmp"
        495⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\905A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905A.tmp"
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\9125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9125.tmp"
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\91D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91D1.tmp"
        498⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\92AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92AC.tmp"
        499⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\9368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9368.tmp"
        500⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\9452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9452.tmp"
        501⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\951D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\951D.tmp"
        502⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\95F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95F8.tmp"
        503⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\96B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96B3.tmp"
        504⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\975F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\975F.tmp"
        505⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\983A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\983A.tmp"
        506⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\9905.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9905.tmp"
        507⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\99E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E0.tmp"
        508⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\9AAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"
        509⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\9B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B76.tmp"
        510⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\9C41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C41.tmp"
        511⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\9CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"
        512⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\9DA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"
        513⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\9E74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E74.tmp"
        514⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\9F4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"
        515⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\A01A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A01A.tmp"
        516⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\A0B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0B6.tmp"
        517⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\A171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A171.tmp"
        518⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\A21D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A21D.tmp"
        519⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\A2C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"
        520⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\A394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A394.tmp"
        521⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\A440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A440.tmp"
        522⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\A4FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4FC.tmp"
        523⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\A5B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5B7.tmp"
        524⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\A673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A673.tmp"
        525⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\A72E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A72E.tmp"
        526⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\A7EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"
        527⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\A8B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"
        528⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\A961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A961.tmp"
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\AA0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA0C.tmp"
        530⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\AAB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAB8.tmp"
        531⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\AB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB74.tmp"
        532⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\AC20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC20.tmp"
        533⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\ACDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACDB.tmp"
        534⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\AD87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD87.tmp"
        535⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\AE43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE43.tmp"
        536⤵
        System Location Discovery: System Language Discovery
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\AEEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEEE.tmp"
        537⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\AFBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFBA.tmp"
        538⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\B065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B065.tmp"
        539⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\B111.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B111.tmp"
        540⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\B1EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1EC.tmp"
        541⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\B298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B298.tmp"
        542⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\B363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B363.tmp"
        543⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\B42E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B42E.tmp"
        544⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\B4DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4DA.tmp"
        545⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\B586.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B586.tmp"
        546⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\B632.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B632.tmp"
        547⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\B6ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6ED.tmp"
        548⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\B7A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7A9.tmp"
        549⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\B864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B864.tmp"
        550⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\B92F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B92F.tmp"
        551⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\B9FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9FB.tmp"
        552⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\BA97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA97.tmp"
        553⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\BB62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB62.tmp"
        554⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\BC1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC1D.tmp"
        555⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\BCC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCC9.tmp"
        556⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\BD85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD85.tmp"
        557⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\BE50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE50.tmp"
        558⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\BF1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"
        559⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\BFD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFD7.tmp"
        560⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\C092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C092.tmp"
        561⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\C15D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C15D.tmp"
        562⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\C228.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C228.tmp"
        563⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\C2D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D4.tmp"
        564⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\C390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C390.tmp"
        565⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\C43C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C43C.tmp"
        566⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\C507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C507.tmp"
        567⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\C5B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5B3.tmp"
        568⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\C67E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C67E.tmp"
        569⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\C72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C72A.tmp"
        570⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\C7E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7E5.tmp"
        571⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\C8A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8A1.tmp"
        572⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\C95C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C95C.tmp"
        573⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\CA08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA08.tmp"
        574⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\CAC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAC3.tmp"
        575⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\CB7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB7F.tmp"
        576⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\CC2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC2B.tmp"
        577⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\CCD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCD7.tmp"
        578⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\CD83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD83.tmp"
        579⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\CE2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE2E.tmp"
        580⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\CECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CECB.tmp"
        581⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        582⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\D032.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D032.tmp"
        583⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\D0CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0CE.tmp"
        584⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\D17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17A.tmp"
        585⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\D226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D226.tmp"
        586⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\D2F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F1.tmp"
        587⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\D39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D39D.tmp"
        588⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\D487.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D487.tmp"
        589⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\D533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D533.tmp"
        590⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\D5EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5EF.tmp"
        591⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\D69B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D69B.tmp"
        592⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\D766.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D766.tmp"
        593⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\D812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D812.tmp"
        594⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\D8AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8AE.tmp"
        595⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\D95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D95A.tmp"
        596⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\DA15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA15.tmp"
        597⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\DAD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAD1.tmp"
        598⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\DB8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB8C.tmp"
        599⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\DC48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC48.tmp"
        600⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\DD03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD03.tmp"
        601⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\DDCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDCE.tmp"
        602⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\DE8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8A.tmp"
        603⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\DF45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF45.tmp"
        604⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\DFE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFE2.tmp"
        605⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\E07E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E07E.tmp"
        606⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\E149.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E149.tmp"
        607⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\E205.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E205.tmp"
        608⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\E2B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2B0.tmp"
        609⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\E36C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E36C.tmp"
        610⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\E418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E418.tmp"
        611⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\E4C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"
        612⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\E58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E58F.tmp"
        613⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\E61B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E61B.tmp"
        614⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\E6E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6E7.tmp"
        615⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\E792.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E792.tmp"
        616⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\E83E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E83E.tmp"
        617⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\E8FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8FA.tmp"
        618⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\E986.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E986.tmp"
        619⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\EA32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA32.tmp"
        620⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\EAFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAFD.tmp"
        621⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\EBC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBC9.tmp"
        622⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\EC74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC74.tmp"
        623⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\ED30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED30.tmp"
        624⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\EDDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDDC.tmp"
        625⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\EEA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEA7.tmp"
        626⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\EF53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF53.tmp"
        627⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\F00E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F00E.tmp"
        628⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\F0D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0D9.tmp"
        629⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\F185.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F185.tmp"
        630⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\F270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F270.tmp"
        631⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\F31C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F31C.tmp"
        632⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\F3B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3B8.tmp"
        633⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\F464.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F464.tmp"
        634⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\F510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F510.tmp"
        635⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\F5DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5DB.tmp"
        636⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\F696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F696.tmp"
        637⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\F771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F771.tmp"
        638⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\F82C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F82C.tmp"
        639⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\F8C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8C9.tmp"
        640⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\F984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F984.tmp"
        641⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\FA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA30.tmp"
        642⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\FADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FADC.tmp"
        643⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\FB78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB78.tmp"
        644⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\FC43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC43.tmp"
        645⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\FCFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCFF.tmp"
        646⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\FDBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDBA.tmp"
        647⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\FE57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE57.tmp"
        648⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\FF22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF22.tmp"
        649⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\FFDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFDD.tmp"
        650⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89.tmp"
        651⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\145.tmp"
        652⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\21F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21F.tmp"
        653⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\2BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC.tmp"
        654⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\387.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\387.tmp"
        655⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\423.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\423.tmp"
        656⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\50D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50D.tmp"
        657⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\5B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B9.tmp"
        658⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\694.tmp"
        659⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\740.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\740.tmp"
        660⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\7EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EC.tmp"
        661⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\8B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B7.tmp"
        662⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\963.tmp"
        663⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1E.tmp"
        664⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\ADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADA.tmp"
        665⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B86.tmp"
        666⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\C41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C41.tmp"
        667⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\CED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CED.tmp"
        668⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D99.tmp"
        669⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\E54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E54.tmp"
        670⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF1.tmp"
        671⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\FDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDB.tmp"
        672⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\1077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1077.tmp"
        673⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\1123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1123.tmp"
        674⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\11EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11EE.tmp"
        675⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\128A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\128A.tmp"
        676⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\1346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1346.tmp"
        677⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\1401.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1401.tmp"
        678⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\14AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14AD.tmp"
        679⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\1569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1569.tmp"
        680⤵
        
        PID:6692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\10A0.tmp
Size 3.6MB
SHA256 cf436965fc577c35678e8e206f369a1a0bc4a18d2b2a7ca445fa6a9a8685eb74
MD5 2eef456debbd995453cb16955c79980a
SHA1 b83d700191f37d33be190b476d0b412a53031206
SHA512 c9b3cb56ce94ca325b710b834850bc3a61616c046a1df2e03d87777e016e0c43dc4b7948d8ac7e1e908a70d919ef291f54005ee615d6617b92029603e6a5c572
SSDEEP 49152:w/OJDGs3z0oGPUNGEADt7i+/yTukuFGNLrkBirx:EOb1JchrSiGdkBirx
TLSH
T17306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1311.tmp

Path C:\Users\Admin\AppData\Local\Temp\1311.tmp
Size 3.6MB
SHA256 ddcb6d4a9055ca27db48ef2db89a9da4e275ab63576559ccec72887b5c01f942
MD5 18bab78f3ab81e6526fe9561d6c91a88
SHA1 58e9e1b70fb35e1518033bfc1b9a4bacd87630ee
SHA512 432f86078b01d80eda78754a521ff091a8dfcfc3115b3d9f8426fff475c5e315364802c96cdc00f251cb6dc6672a2ef5556b909180fda3e36ec15150fd84919e
SSDEEP 49152:w/OJD/okDANGEADt7i+/yTukuFGNLrkBirx:EOWvchrSiGdkBirx
TLSH
T1C306831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\15C0.tmp
Size 3.6MB
SHA256 e2b90721841587249b4e77130cc706811b980abfb578903b218e1fa46340c6e4
MD5 4423e07c07c79e46e34c6415aa5cb4c4
SHA1 5a9a22bf3287d8bdb6086883d6698345ea042b72
SHA512 201fb5fdab6d446df7f4c852f31f1daac3b20150cc7c8fea0918bd6942881439902e7389e8645e674bfdb4743e8f479c8cf24497ff5e32c7a0dcba25b1f97181
SSDEEP 49152:w/OJDN5z4RvNGEADt7i+/yTukuFGNLrkBirx:EO5OchrSiGdkBirx
TLSH
T1ED06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

188F.tmp

Path C:\Users\Admin\AppData\Local\Temp\188F.tmp
Size 3.6MB
SHA256 c95c79bf7d754aa6f4252d86554c5d9882b62336cb5072012062904772ed864b
MD5 c1d15499269b91ae36c7ef96260748cc
SHA1 801b92fde49c99150d215390e839ebab1b70c181
SHA512 35e9461e378d56273025aea50c59e45d51d4721b6a2c385eb5aa988620b11d2cd4e70751327e4b9660e64b17083e34ede2cde311f6fee55f2f5568fb039e5996
SSDEEP 49152:w/OJDFIBzLNGEADt7i+/yTukuFGNLrkBirx:EOEBzLchrSiGdkBirx
TLSH
T1BD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AC.tmp
Size 3.6MB
SHA256 0fc6e5ea03b7eb59941e7cc1d6ce5f9e9f267b839a0afe5dcb447bca769883e7
MD5 72c30d9bb0d9b3712f9c5a0b7652d225
SHA1 7929873b7343ccffd989647dea516074ad34244b
SHA512 33c8c213f44a9414e4a8c13432ea0f5f8360856baa7ad28c5e446d53b8ae57dedadb26a47581bc61498441e169cfcf426e3c50211cbd9e4c41245d3b2c8a68a6
SSDEEP 49152:w/OJDnqOX2sNGEADt7i+/yTukuFGNLrkBirx:EO1qOXfchrSiGdkBirx
TLSH
T1D306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AE1.tmp
Size 3.6MB
SHA256 1fb1b869401584e6c2f8ef8b309aa91ec6682a06041655366b07136c860bfe98
MD5 28bc42ddf456177d01300bf0ffeb697b
SHA1 c5af6abc55683b6c2b798157d277d3e0a1190cb4
SHA512 0f9dc93343901300c0d8708eee1e7619d9ce6b9d50b789e3e7775cc80609696f5b8b1454ad7d2c6e4ee7d524fdc420617365f635de23ed60f4dab2f805bdfd30
SSDEEP 49152:w/OJD00081YbW3NGEADt7i+/yTukuFGNLrkBirx:EO206bW3chrSiGdkBirx
TLSH
T14B06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D90.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D90.tmp
Size 3.6MB
SHA256 32aca3f27b22965e5533b68e766c6a312cbf836fe8a889a966567685d6b3fea8
MD5 10923811c53134ffe1eeca0431b9a347
SHA1 19e7ae94a14b45f7c3bf306c0061edca7873761c
SHA512 04e6afcf019d19cd058f0f92c1dc39d0878d72d43fc49d40912ef9cc12ac0dc3ed7853d682cdf801192851d03219d4502072f95eb97ebd5ffd8f5dbe02f8bc52
SSDEEP 49152:w/OJDzvJYyNGEADt7i+/yTukuFGNLrkBirx:EOXBchrSiGdkBirx
TLSH
T14F06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2021.tmp

Path C:\Users\Admin\AppData\Local\Temp\2021.tmp
Size 3.6MB
SHA256 63e378c3e80ead41f5a7b120589d867dd52ff00b542d5a1ab1067e15fcf91a1e
MD5 1204cf3667f907ad559b12b6753238a7
SHA1 49c03b85865b047d33951ff8abbf1c516458402f
SHA512 a69396e4c273296c01244d3faa088fff5375ddfbfef0a7af9cd549a5e1a335c13ce78a53fe15abacd030ab487dd832f8aae17a7e15fe075786326050c6181a16
SSDEEP 49152:w/OJDsmI2clNGEADt7i+/yTukuFGNLrkBirx:EO+lchrSiGdkBirx
TLSH
T1B306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54.tmp

Path C:\Users\Admin\AppData\Local\Temp\54.tmp
Size 3.6MB
SHA256 6843634ce4822bfc27d4fa0346e13bc2b14e61f01c4981b23e6ec3ba915b6c56
MD5 5d95b39c5743e5378a7e21921875506c
SHA1 6791285ffc645e373d5ea1e6ff0624105ef32c3e
SHA512 e04e86b2f5c1721e9d427622e514b74fdfbd53b3884e8e156e90e1ca776df032bb9f73ae778ab0b2596af0d53c5b0f8aaffd27cd32576a17856a5199a1690156
SSDEEP 49152:w/OJDNOoe7aDdRNGEADt7i+/yTukuFGNLrkBirx:EOKd7ERchrSiGdkBirx
TLSH
T1B606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

546.tmp

Path C:\Users\Admin\AppData\Local\Temp\546.tmp
Size 3.6MB
SHA256 813762ea198c3a362b3051987588f7cf6cefca42b4ada86c4b2858a35fba50f2
MD5 15857fd46a317b4f946019d18e7bc741
SHA1 ad6e1988086a40f10ebfc384750595342db2fe2c
SHA512 74c164f3155c93f267976212d95a7297401e62361dbe47f2ee9a1bda4234f011e0d988533e4b1008698f7d7f13af4ed9c7e977ce60c9779b45f46449fb5f00ff
SSDEEP 49152:w/OJDiT7gyNGEADt7i+/yTukuFGNLrkBirx:EOcXVchrSiGdkBirx
TLSH
T19706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

843.tmp

Path C:\Users\Admin\AppData\Local\Temp\843.tmp
Size 3.6MB
SHA256 0af2cfa9782340d0dc588e3ab1764c77a248aee289bc8b523e04278f7776dd85
MD5 485e4eab31441acedab66550c6d46c1d
SHA1 42a35655ec51573ebfeae9ccff71514b39f4b724
SHA512 14e4d6d679f5aa72bd216518d85818cdef3d7657b13af71d292560c47c568b358a7384f41a313621e885a591e53327bc9bfd3ce910f67190507ff954bcd18719
SSDEEP 49152:w/OJDwyl6OEtjw2G17NGEADt7i+/yTukuFGNLrkBirx:EOaylYCtchrSiGdkBirx
TLSH
T12706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B02.tmp

Path C:\Users\Admin\AppData\Local\Temp\B02.tmp
Size 3.6MB
SHA256 390e625309f04a383e235f3099a6a2f59c55e475add6d46bc689ff94468cf530
MD5 18b4fa07672738d567224d0f4ed32c1b
SHA1 f151df0a11e88a4315a6cac93bcc03649268d944
SHA512 f6e387a52c74d18731b3647479c0acdd476950617ea0a1355977bb03f1c31a810bf4fa15d84ec86070ff1151a834f2898e3a54117057e322cff20a0a32363402
SSDEEP 49152:w/OJDsgiP9CAlcNGEADt7i+/yTukuFGNLrkBirx:EOFiochrSiGdkBirx
TLSH
T17D06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CCC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\CCC1.tmp
Size 3.6MB
SHA256 3677e80fe370647939be94a5a86d7547bdd10a39e0712495c8f160cf44ec09c6
MD5 39ee8f0f811814485747f38fec19ca18
SHA1 9c0b99c93b8701a4c49daf56c328a3c03600aa00
SHA512 5f43072d45683aff468cbd9389f21105c1d1cee48bc602ebccc39ac16350fdaa863c58c7941557a62a73c7bd24b5b448bfd43e7d73045779360fccfe6f065d7e
SSDEEP 49152:w/OJD7MDG47okNGEADt7i+/yTukuFGNLrkBirx:EOdq775chrSiGdkBirx
TLSH
T1D506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF70.tmp

Path C:\Users\Admin\AppData\Local\Temp\CF70.tmp
Size 3.6MB
SHA256 199648a66d341195281d2ee2e471ae3e5eddf3e446716c4807f672e5f50846fa
MD5 69669c4ccfd0981885984e611940d9e3
SHA1 bdfcf3b7c5a512f1c07c79048ce57a87aaf72853
SHA512 3ea4d27ab9d38101565fe15c57db89a0a7976df2ef740da96829f9c4bc599df2c7972917a7caca40b8f31d5a4c7c776ec8dcb078f0da87efe802db0e6143f30a
SSDEEP 49152:w/OJDsoTZNGEADt7i+/yTukuFGNLrkBirx:EOXTZchrSiGdkBirx
TLSH
T11506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\D0E7.tmp
Size 3.6MB
SHA256 4a1ffdf4c61e2a5e434a0c2b777b9c7a5d05874d92696e5ef0ea5a51df92eaaa
MD5 939c154d89c0986abf755390bb63ebed
SHA1 08ff34ec9fc4d96c0e60e2dada98ce36b2846392
SHA512 dabe2fb520ee89c4a28f2bb1074531c94649ac271cb29ac7f2eab9b8ca702bc0e5720143257802a51b3a1a2bffec3690a5610c3230581144330f119f03fe2574
SSDEEP 49152:w/OJDWXNfHFNGEADt7i+/yTukuFGNLrkBirx:EO8chrSiGdkBirx
TLSH
T18406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D4C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\D4C0.tmp
Size 3.6MB
SHA256 d5a3f174206cd868741e6b9354dc695a33223985e3f7942ad227bf5c349d756d
MD5 c480e320a1b5d4ece16a033fd62e0a43
SHA1 fe1a555678e3e07b15dd5c171fa78c460549ffca
SHA512 bd60ad90b1a4c8685dabeeced5a66b6311cb8d0d1c59e94425da6944bd8599549e0e36022625cd0654f1819fac38afc6a28158be8fe65b9fc5dde9739176ca71
SSDEEP 49152:w/OJDu8GmeyNGEADt7i+/yTukuFGNLrkBirx:EOfHhchrSiGdkBirx
TLSH
T12206831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D5F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\D5F8.tmp
Size 3.6MB
SHA256 f1a1ba113f5c9693398629b5f8d7fc16b6a46b82d38b238e3298862db450478b
MD5 7635d09b464a16883df9662cc3966ebc
SHA1 1811f40b82f16572260a94de6b68771cb44b4703
SHA512 9e26b00666c964281a83626d55723532cbee2720075afaa6f2e6df1b15bb34f62a2717decfab21199e1c033a16c185e80b315df2275c89be357f332677fa447b
SSDEEP 49152:w/OJDesnboNGEADt7i+/yTukuFGNLrkBirx:EOMsnbochrSiGdkBirx
TLSH
T10606931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\D6C3.tmp
Size 3.6MB
SHA256 9b10ad47e3419ccfa65017f5266ee008603c9a4ab2ecc57c387b21989ebccff1
MD5 2e20defbcc05a0afae3454a8d40c162f
SHA1 32deac2fd4fbaf17e23eea51c1c6bab989e514b8
SHA512 e5feac43a30469cc597fd13951839242fed2945202bead51b9b07c4c4f858e58022ed68a595725569fb21789906f0caf803be005c7cb46445819993b1495d1b3
SSDEEP 49152:w/OJDmiLHNGEADt7i+/yTukuFGNLrkBirx:EONHchrSiGdkBirx
TLSH
T17106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\DCAF.tmp
Size 3.6MB
SHA256 3c18cf87c077e47b625778a00264e0481c55e363d727333d03ebbfd9656f5b20
MD5 c23b66ebc326b4fe41f550f9fc36ddd3
SHA1 d8bca9edba5f4278d5ee6f570fa71cb407eec0b0
SHA512 14ac5fe81c6e4d60cfa4e4416d1c8563902e1d9069d602e61a604a51a44437fbaa20707c792fc3a35ea53c262b98e725bcf49f55a02ce649ed4fe671048e1305
SSDEEP 49152:w/OJDZyhj9FDGNGEADt7i+/yTukuFGNLrkBirx:EOoFqchrSiGdkBirx
TLSH
T10A06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\DD1.tmp
Size 3.6MB
SHA256 7e3f472a82ced011f27356988af34b28f1a2c8bfdf623cadfee978bbcf86de38
MD5 15109f138c1456e61530de6f4fbd7eae
SHA1 4a7d67aa18854c050be3fc4e4663121070ef49bd
SHA512 8087ab006a95065af5701edd0d7985d06ab8965ee0969b223c93760f2c5359a4db62b9a0e4cc688d6f6a98c526774dde520468dcd17ed388380d431c7f6b5be7
SSDEEP 49152:w/OJDMn44cNGEADt7i+/yTukuFGNLrkBirx:EOin44cchrSiGdkBirx
TLSH
T1F006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DF8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF8D.tmp
Size 3.6MB
SHA256 f59e6819294ea688147e08995bcff3ed5c319ec41aac274774d2fcf10fe8e6ee
MD5 c26c520113ddb633c4765c45edb7eb98
SHA1 181094fb6064ba20cbf0ce56c434e0a694e6d637
SHA512 dd42fc923cef251773e945728a146e97abd720f32c0137ea3c92666c018fb81ee7e6be6d72ad4d8f9f7a110422b070e889113296f336b800ac9570eba38b6665
SSDEEP 49152:w/OJDdf8fEjUNGEADt7i+/yTukuFGNLrkBirx:EOPfeEAchrSiGdkBirx
TLSH
T17506831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E23D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E23D.tmp
Size 3.6MB
SHA256 78c78f45dea90dedf443e1350f4724201e2b89adc3c3202272c596c4ca65085f
MD5 4563d549e1e51612fd1a7b64e81d95a4
SHA1 7e6e4b08c1ab6b081d93533a9e25398ed131fe8d
SHA512 196a2e405f3f32b4044f9154a54ab3932fcc00b8d45546835163adc830b6d75064c204c991cc6b69fb356f406bb43bb6bf44df156e714d13bace0fd7924573f7
SSDEEP 49152:w/OJDDPnoUf2jNGEADt7i+/yTukuFGNLrkBirx:EOFPnoUfkchrSiGdkBirx
TLSH
T1F406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E4EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4EC.tmp
Size 3.6MB
SHA256 301d057532f21c969dd7d173ac90acdc2ffb54f343151ad6ea323eeb5b41cefb
MD5 a5c98735a577371e317d5fa651171d5e
SHA1 9e1710c9f74ccba620fe554145351f995773519b
SHA512 526bccd81ea94bcb5d215d3fd17b918fe9a22f678fc1bb81bd59a0b76473b6107b9f591b71def82fb867bdd6ae113ef05a1dedd9b5aecc938694ba0ffd027cc5
SSDEEP 49152:w/OJDEIOP8NGEADt7i+/yTukuFGNLrkBirx:EOClP8chrSiGdkBirx
TLSH
T12906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E77D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E77D.tmp
Size 3.6MB
SHA256 e14783e600ea6b3459029364408c985a4141f6ed5938772a34ab146bd4487936
MD5 34add3bf4392999e591b51b27d1bcfaa
SHA1 9fcb94d5ba89149e6e7a72e3cef1a1f5b58f90ff
SHA512 c5568646ddccf0557df235b25955e15a190967440f51f60cb2e0fba2f622ebd80629c3769ee7e0088cc4ee16a30ba7d9554ccdcc1b8406190068617539ebee00
SSDEEP 49152:w/OJDbp6JQ6roZaNGEADt7i+/yTukuFGNLrkBirx:EOTMjPchrSiGdkBirx
TLSH
T18906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9EE.tmp
Size 3.6MB
SHA256 c516899b079a400dca9dadadbb19def5e807f30cf03b5fb1be6fc37498d40daf
MD5 399d1487226922d709325b108867ef5b
SHA1 a83d446b45c9df5d58df48ef1eb077f342378b7a
SHA512 2b78a0b68894659a0efe204765e7ddea2f97f2859a3f0a931d623af02ad2044bb38caaf151c227b91e00f27967c05b56f0de17122b0c578dd3f93a5825bd1f05
SSDEEP 49152:w/OJDFLf0NGEADt7i+/yTukuFGNLrkBirx:EO7r0chrSiGdkBirx
TLSH
T18006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EC9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC9D.tmp
Size 3.6MB
SHA256 e487e781ae170aa0322a8421b657392b7ffa7a45437a2d2a64caad6812c04d99
MD5 e99ffdd54fbd48cb2338d3ffff11bb1b
SHA1 193d371b0e589601ec1acc2cce2000c47e633d90
SHA512 980bf10d0033a1f706ee5d8cb045a1c6ddd438b04e9fdc9011f051b25a89487ce21b41d11a0ccf9d1e592fe744823f4bbf387ebfe6b74de91263de3ef6d5d169
SSDEEP 49152:w/OJDdgu2NGEADt7i+/yTukuFGNLrkBirx:EO7gu2chrSiGdkBirx
TLSH
T1B506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\EF6C.tmp
Size 3.6MB
SHA256 97466349c893118190cb666a0d55e4005489de9ffb42a63c67a952c1f0a16cb9
MD5 384e1a7898cedcb19b9c88cf9b81d47a
SHA1 c6dcb9e84fabf0142834bed8c069241d0359fbcb
SHA512 c370fedb5fcb4f71de43a62d5ef43a55c3cf414efe9a23712fa4be4b0c0aceb8e82e176d0a52aec4d96232d9e4798606c28c5e9955197335bdb0fe5525c0861d
SSDEEP 49152:w/OJD50JvPNGEADt7i+/yTukuFGNLrkBirx:EOHmPchrSiGdkBirx
TLSH
T19E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F1FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\F1FC.tmp
Size 3.6MB
SHA256 2ce106957aeec080c04d6ed7e311b2e3804d14de7eeae3d50a50f36532a57f56
MD5 92558d7dcd22495a5d1944f6fceeab81
SHA1 a36df4b7cedc513921ef0e618243b0fd43d8530f
SHA512 9a1340d92c10215f55bd8e80c35e86ded843743c19453097a271923bd6ea1284ee5a2684b372637882dc75cc97b2cd89e4d5fd109ef75ade90c5edd934c48a5f
SSDEEP 49152:w/OJDkQJfg9iNGEADt7i+/yTukuFGNLrkBirx:EO+Ifg9ichrSiGdkBirx
TLSH
T1BF06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F46D.tmp

Path C:\Users\Admin\AppData\Local\Temp\F46D.tmp
Size 3.6MB
SHA256 d57db6f8112b1668a96241eaa79fb41b5bb43d9e08ae8225eba2df61a69ae958
MD5 32d048d2adbd4f7a31aa9cd4615b6ed5
SHA1 6f68b5282f962d817e1b82d6d89b15097f92cde4
SHA512 f85e3d679516640642a120d4f74bc5dc74202526906b9a7de8ff32e822ccbc69aefe4c95d1859f6afe1785e660dc101a8443c874cbe5e86a10cedfda50b27b18
SSDEEP 49152:w/OJDniwFNGEADt7i+/yTukuFGNLrkBirx:EOZiSchrSiGdkBirx
TLSH
T17106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6FD.tmp
Size 3.6MB
SHA256 aa709e911f2c990c428ac64ace3b1fdf5a3354d1122517a1866f0bfc54b1f2ba
MD5 25d56c4e08ee070e6edd8dbf9f0f66c9
SHA1 2fa25a3b2e038abdfb4c98bf92084c4f228770b8
SHA512 9cef119e28ef89f4d8b9413396d182b4079d1dd1475a9e99926a468e97a62009c422641f90e0358df119d3830851bd9eb9393756677cc396884f134406225a22
SSDEEP 49152:w/OJDXfpCANGEADt7i+/yTukuFGNLrkBirx:EOXCAchrSiGdkBirx
TLSH
T1CF06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F9CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9CC.tmp
Size 3.6MB
SHA256 c4aef6a7b0bd58aef068a120c613014907702c66ee353c39da1c3cffec0b22d2
MD5 96ade2b6250b28e9267f8d4dd1c342dd
SHA1 806962665b1308b9ca68422ed0d0ac0134f3250a
SHA512 e46255bc59f0301ebecbb0011390270330d3e5cfc05a8d2ee4b24348efcc044c545ddb12b63693fbc783206c8ac4ec81b1f8c66be698ce40fe5e555d74da1da3
SSDEEP 49152:w/OJD8QhWT7D5NGEADt7i+/yTukuFGNLrkBirx:EOub5chrSiGdkBirx
TLSH
T13D06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\FCE9.tmp
Size 3.6MB
SHA256 77546bad80c9bc15407eec6873eaeb55819a45669053d66fbddfeff14baaa916
MD5 2ff3dbf51f89386ea9d3672df66ab39a
SHA1 2cb4fbcfca4e3b4ead131796915b1d9be20fb2a8
SHA512 bfaae86568fbea774b71602e6bf5c7605112c74cd712a44e25bb61542dfb56c518afccbb820a0f7e9395161e3061f37ef4829c696d5c6aff04c14b90ef568f62
SSDEEP 49152:w/OJDC5TDHT/NGEADt7i+/yTukuFGNLrkBirx:EOQvHjchrSiGdkBirx
TLSH
T19506931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-175-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/260-167-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/692-46-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/692-54-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/796-180-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/796-188-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/856-194-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/856-187-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/1136-25-0x00000000004A0000-0x0000000000523000-memory.dmp

Download

memory/1136-34-0x00000000004A0000-0x0000000000523000-memory.dmp

Download

memory/1156-131-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/1156-125-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/1200-202-0x0000000000C40000-0x0000000000CC3000-memory.dmp

Download

memory/1200-195-0x0000000000C40000-0x0000000000CC3000-memory.dmp

Download

memory/1228-20-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1228-11-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1288-238-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/1288-244-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/1432-13-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/1432-5-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/1560-153-0x00000000003C0000-0x0000000000443000-memory.dmp

Download

memory/1560-145-0x00000000003C0000-0x0000000000443000-memory.dmp

Download

memory/1768-264-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/1768-258-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/1772-173-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/1772-181-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/1820-18-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/1820-27-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/2024-152-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/2024-160-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/2072-283-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/2072-289-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/2152-39-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/2152-47-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/2388-215-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/2388-223-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/2672-89-0x0000000000960000-0x00000000009E3000-memory.dmp

Download

memory/2672-98-0x0000000000960000-0x00000000009E3000-memory.dmp

Download

memory/2800-303-0x00000000005C0000-0x0000000000643000-memory.dmp

Download

memory/2852-110-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/2852-117-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/3256-263-0x0000000000CD0000-0x0000000000D53000-memory.dmp

Download

memory/3256-269-0x0000000000CD0000-0x0000000000D53000-memory.dmp

Download

memory/3896-69-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/3896-62-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/3908-124-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/3908-118-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/3968-82-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/3968-90-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/4076-228-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4076-234-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4164-0-0x0000000000EC0000-0x0000000000F43000-memory.dmp

Download

memory/4164-60-0x0000000000EC0000-0x0000000000F43000-memory.dmp

Download

memory/4192-259-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/4192-253-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/4248-239-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/4248-233-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/4284-278-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/4284-273-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/4492-243-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/4492-249-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/4504-84-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4504-75-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4528-139-0x0000000000600000-0x0000000000683000-memory.dmp

Download

memory/4528-146-0x0000000000600000-0x0000000000683000-memory.dmp

Download

memory/4696-298-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/4888-216-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/4888-208-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/5016-68-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5016-77-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5020-103-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/5020-111-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/5436-224-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/5436-229-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/5656-279-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/5656-284-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/5760-248-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/5760-254-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/5780-268-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/5780-274-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/5852-41-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/5852-32-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/5880-105-0x0000000000CA0000-0x0000000000D23000-memory.dmp

Download

memory/5880-96-0x0000000000CA0000-0x0000000000D23000-memory.dmp

Download

memory/5912-210-0x0000000000260000-0x00000000002E3000-memory.dmp

Download

memory/5912-201-0x0000000000260000-0x00000000002E3000-memory.dmp

Download

memory/5976-133-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/5976-140-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/5988-166-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/5988-159-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/6008-288-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/6008-294-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/6048-293-0x00000000006A0000-0x0000000000723000-memory.dmp

Download

memory/6048-299-0x00000000006A0000-0x0000000000723000-memory.dmp

Download

memory/6072-53-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/6072-61-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads