4d6ab0f875699741318cb98c6b4c758145ab8c22d7303bbda8c05da0617fd218

Analysis

max time kernel
50s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_0020fa33e052f0ba5e7775fb110865d1_elex_mafia_stealc_tofsee.exe
Size 652KB
Sample260708-ftgflabv5y
SHA256 4d6ab0f875699741318cb98c6b4c758145ab8c22d7303bbda8c05da0617fd218
MD5 0020fa33e052f0ba5e7775fb110865d1
SHA1 cef711d2fc435624874aeabe35535da940c3215c
SHA512 a134f657ec5a3f43ed77a94df3b64e84e3c22aec0e35141d48e84043eacc6f2941d764df5207531944277952d90bbda091a9b22a2459fb4cba84316a9f0ef3e2
SSDEEP 12288:wU5rCOTeiDUmBxluBIOTIJv5WQw2hC3wlY2NZ+3/v+I9hUG2VA:wUQOJDU0nansp5Hw2pfNGEA
TLSH
T1D0E4D12173D88632E5FB037859B5E6614E7EBD366722D6CF2F8016AE0971BD08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
708	F008.tmp
956	F325.tmp
3772	F671.tmp
3528	F894.tmp
2844	FAC6.tmp
4064	FD56.tmp
1872	FF89.tmp
4716	219.tmp
2008	44C.tmp
4668	5E2.tmp
5756	7F5.tmp
3260	A08.tmp
4400	C5A.tmp
1844	DB2.tmp
1532	10BF.tmp
6140	1275.tmp
2452	1459.tmp
1056	16BA.tmp
4536	197A.tmp
5852	1BDB.tmp
4268	1DB0.tmp
1564	1F94.tmp
2424	2169.tmp
4300	23AB.tmp
348	2541.tmp
5228	2764.tmp
1732	290A.tmp
1040	2C36.tmp
2148	2EF6.tmp
724	3109.tmp
5116	33B8.tmp
616	35DB.tmp
3868	38BA.tmp
3584	39F2.tmp
1368	3B1B.tmp
2956	3C53.tmp
3756	3D3E.tmp
2756	3EA5.tmp
2372	405B.tmp
4524	4155.tmp
4772	42BC.tmp
4856	43E5.tmp
2412	450E.tmp
5408	4617.tmp
4084	4750.tmp
6064	4879.tmp
3136	4963.tmp
1896	4A6D.tmp
4568	4B48.tmp
3092	4C22.tmp
2872	4D0D.tmp
1408	4E26.tmp
5836	4F5E.tmp
1444	501A.tmp
2564	5124.tmp
4852	520E.tmp
5352	52BA.tmp
2840	53A4.tmp
968	549E.tmp
6112	5569.tmp
3264	5654.tmp
4132	574E.tmp
5112	5838.tmp
2588	5932.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6884.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7778.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B1D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5654.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9919.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9BC9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FAC6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3109.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4155.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D0D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C5C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	891C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFED.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2764.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DCF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DBD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A138.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD0F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADDA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38BA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43E5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81A9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A762.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C5A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	197A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5AA9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4963.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6920.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7882.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	861E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	219.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	966A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2169.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	405B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ECD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	714E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	742C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86E9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	905F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A4E1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BDB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D3E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4879.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E26.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5838.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9263.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	938C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AED4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5124.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5569.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E14.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64DA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A251.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8D9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F94.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B84.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5D49.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61FC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6AD6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71FA.tmp

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{6D95B2D9-CBA9-4AA7-92CB-38F2303A4D60}	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1016	explorer.exe
Token: SeCreatePagefilePrivilege	1016	explorer.exe
Token: SeShutdownPrivilege	1016	explorer.exe
Token: SeCreatePagefilePrivilege	1016	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 708	5044	2026-07-08_0020fa33e052f0ba5e7775fb110865d1_elex_mafia_stealc_tofsee.exe	88
PID 708 wrote to memory of 956	708	F008.tmp	89
PID 956 wrote to memory of 3772	956	F325.tmp	90
PID 3772 wrote to memory of 3528	3772	F671.tmp	91
PID 3528 wrote to memory of 2844	3528	F894.tmp	92
PID 2844 wrote to memory of 4064	2844	FAC6.tmp	93
PID 4064 wrote to memory of 1872	4064	FD56.tmp	94
PID 1872 wrote to memory of 4716	1872	FF89.tmp	95
PID 4716 wrote to memory of 2008	4716	219.tmp	96
PID 2008 wrote to memory of 4668	2008	44C.tmp	97
PID 4668 wrote to memory of 5756	4668	5E2.tmp	98
PID 5756 wrote to memory of 3260	5756	7F5.tmp	99
PID 3260 wrote to memory of 4400	3260	A08.tmp	100
PID 4400 wrote to memory of 1844	4400	C5A.tmp	101
PID 1844 wrote to memory of 1532	1844	DB2.tmp	102
PID 1532 wrote to memory of 6140	1532	10BF.tmp	103
PID 6140 wrote to memory of 2452	6140	1275.tmp	104
PID 2452 wrote to memory of 1056	2452	1459.tmp	105
PID 1056 wrote to memory of 4536	1056	16BA.tmp	106
PID 4536 wrote to memory of 5852	4536	197A.tmp	107
PID 5852 wrote to memory of 4268	5852	1BDB.tmp	108
PID 4268 wrote to memory of 1564	4268	1DB0.tmp	109
PID 1564 wrote to memory of 2424	1564	1F94.tmp	110
PID 2424 wrote to memory of 4300	2424	2169.tmp	111
PID 4300 wrote to memory of 348	4300	23AB.tmp	112
PID 348 wrote to memory of 5228	348	2541.tmp	113
PID 5228 wrote to memory of 1732	5228	2764.tmp	114
PID 1732 wrote to memory of 1040	1732	290A.tmp	115
PID 1040 wrote to memory of 2148	1040	2C36.tmp	116
PID 2148 wrote to memory of 724	2148	2EF6.tmp	117
PID 724 wrote to memory of 5116	724	3109.tmp	118
PID 5116 wrote to memory of 616	5116	33B8.tmp	119
PID 616 wrote to memory of 3868	616	35DB.tmp	120
PID 3868 wrote to memory of 3584	3868	38BA.tmp	121
PID 3584 wrote to memory of 1368	3584	39F2.tmp	122
PID 1368 wrote to memory of 2956	1368	3B1B.tmp	123
PID 2956 wrote to memory of 3756	2956	3C53.tmp	124
PID 3756 wrote to memory of 2756	3756	3D3E.tmp	125
PID 2756 wrote to memory of 2372	2756	3EA5.tmp	126
PID 2372 wrote to memory of 4524	2372	405B.tmp	127
PID 4524 wrote to memory of 4772	4524	4155.tmp	128
PID 4772 wrote to memory of 4856	4772	42BC.tmp	129
PID 4856 wrote to memory of 2412	4856	43E5.tmp	130
PID 2412 wrote to memory of 5408	2412	450E.tmp	131
PID 5408 wrote to memory of 4084	5408	4617.tmp	132
PID 4084 wrote to memory of 6064	4084	4750.tmp	133
PID 6064 wrote to memory of 3136	6064	4879.tmp	134
PID 3136 wrote to memory of 1896	3136	4963.tmp	135
PID 1896 wrote to memory of 4568	1896	4A6D.tmp	136
PID 4568 wrote to memory of 3092	4568	4B48.tmp	137
PID 3092 wrote to memory of 2872	3092	4C22.tmp	138
PID 2872 wrote to memory of 1408	2872	4D0D.tmp	139
PID 1408 wrote to memory of 5836	1408	4E26.tmp	140
PID 5836 wrote to memory of 1444	5836	4F5E.tmp	141
PID 1444 wrote to memory of 2564	1444	501A.tmp	142
PID 2564 wrote to memory of 4852	2564	5124.tmp	143
PID 4852 wrote to memory of 5352	4852	520E.tmp	144
PID 5352 wrote to memory of 2840	5352	52BA.tmp	145
PID 2840 wrote to memory of 968	2840	53A4.tmp	146
PID 968 wrote to memory of 6112	968	549E.tmp	147
PID 6112 wrote to memory of 3264	6112	5569.tmp	148
PID 3264 wrote to memory of 4132	3264	5654.tmp	149
PID 4132 wrote to memory of 5112	4132	574E.tmp	150
PID 5112 wrote to memory of 2588	5112	5838.tmp	151

C:\Users\Admin\AppData\Local\Temp\2026-07-08_0020fa33e052f0ba5e7775fb110865d1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_0020fa33e052f0ba5e7775fb110865d1_elex_mafia_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\F008.tmp
  "C:\Users\Admin\AppData\Local\Temp\F008.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Users\Admin\AppData\Local\Temp\F325.tmp
    "C:\Users\Admin\AppData\Local\Temp\F325.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\F671.tmp
      "C:\Users\Admin\AppData\Local\Temp\F671.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\F894.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F894.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\FAC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\FD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD56.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\FF89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF89.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\219.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\219.tmp"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\44C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44C.tmp"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\5E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E2.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\7F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F5.tmp"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\A08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A08.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\C5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5A.tmp"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\DB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB2.tmp"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\10BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10BF.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\1275.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1275.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\1459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1459.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\16BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16BA.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\197A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\197A.tmp"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\1BDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\1DB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\1F94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F94.tmp"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\2169.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2169.tmp"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\23AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23AB.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\2541.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2541.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\2764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2764.tmp"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\290A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\290A.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\2C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C36.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\2EF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\3109.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3109.tmp"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\33B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33B8.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\35DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35DB.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\38BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38BA.tmp"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\39F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39F2.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\3B1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\3C53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C53.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\3D3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\405B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\405B.tmp"
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\4155.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4155.tmp"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\42BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42BC.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\43E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43E5.tmp"
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\450E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\450E.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\4617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4617.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\4750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4750.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\4879.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4879.tmp"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\4963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4963.tmp"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\4A6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\4B48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B48.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\4C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C22.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\4D0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\4E26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E26.tmp"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\4F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\501A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\501A.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\5124.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5124.tmp"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\520E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\520E.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\52BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52BA.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\53A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53A4.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\549E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\549E.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\5569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5569.tmp"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\5654.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5654.tmp"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\574E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\574E.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\5838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5838.tmp"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\5932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5932.tmp"
        65⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\59DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59DE.tmp"
        66⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\5AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\5B84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B84.tmp"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\5C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"
        69⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\5D49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D49.tmp"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\5E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E14.tmp"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\5F7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"
        72⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\6095.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6095.tmp"
        73⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\6150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6150.tmp"
        74⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\61FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61FC.tmp"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\62E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62E6.tmp"
        76⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\63D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63D1.tmp"
        77⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\64DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64DA.tmp"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\65D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65D4.tmp"
        79⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\66CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66CE.tmp"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\677A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\677A.tmp"
        81⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\6884.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6884.tmp"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\6920.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6920.tmp"
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\69FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69FB.tmp"
        84⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\6AD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\6B82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B82.tmp"
        86⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\6C5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\6D47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D47.tmp"
        88⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\6E02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E02.tmp"
        89⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\6ECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\6FB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"
        91⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\7092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7092.tmp"
        92⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\714E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\714E.tmp"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\71FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71FA.tmp"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\72D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72D5.tmp"
        95⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\7380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7380.tmp"
        96⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\742C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\742C.tmp"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\74E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74E8.tmp"
        98⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\75E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75E2.tmp"
        99⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\768E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\768E.tmp"
        100⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\7778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7778.tmp"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\7882.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7882.tmp"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\799B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\799B.tmp"
        103⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\7A37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A37.tmp"
        104⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\7B41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B41.tmp"
        105⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\7C4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"
        106⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\7D54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D54.tmp"
        107⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\7E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"
        108⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\7F87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F87.tmp"
        109⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\8081.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8081.tmp"
        110⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\81A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81A9.tmp"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\82A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82A3.tmp"
        112⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\839D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\839D.tmp"
        113⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\8449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8449.tmp"
        114⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\8543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8543.tmp"
        115⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\861E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\861E.tmp"
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\86E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86E9.tmp"
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\8802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8802.tmp"
        118⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\891C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\891C.tmp"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\8A16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A16.tmp"
        120⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\8AF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"
        121⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\8C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C19.tmp"
        122⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\8CD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"
        123⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\8DCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\8F17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F17.tmp"
        125⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\905F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905F.tmp"
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\913A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\913A.tmp"
        127⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\9263.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9263.tmp"
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\938C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\938C.tmp"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\9495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9495.tmp"
        130⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\959F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\959F.tmp"
        131⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\966A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\966A.tmp"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\9735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9735.tmp"
        133⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\97F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97F1.tmp"
        134⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\9919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9919.tmp"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\9A33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A33.tmp"
        136⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\9B1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\9BC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\9CC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"
        139⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\9DBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\9E59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E59.tmp"
        141⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\9F24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F24.tmp"
        142⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\A02E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A02E.tmp"
        143⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\A138.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A138.tmp"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\A251.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A251.tmp"
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\A33B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A33B.tmp"
        146⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\A3E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"
        147⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\A4E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\A57D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A57D.tmp"
        149⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\A697.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A697.tmp"
        150⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\A762.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A762.tmp"
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\A81D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A81D.tmp"
        152⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\A8D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\A9A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"
        154⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\AA40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA40.tmp"
        155⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\AAEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"
        156⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\ABB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"
        157⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\AC63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC63.tmp"
        158⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\AD0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\ADDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\AED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AED4.tmp"
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\AFED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFED.tmp"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\B126.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B126.tmp"
        163⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\B200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B200.tmp"
        164⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\B2EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"
        165⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\B52D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B52D.tmp"
        166⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\B7BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"
        167⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\BB67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB67.tmp"
        168⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\C0C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"
        169⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\C598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C598.tmp"
        170⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\C951.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C951.tmp"
        171⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\D3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"
        172⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\D5B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"
        173⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\D6EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"
        174⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\D807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D807.tmp"
        175⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\D8C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"
        176⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\D97E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D97E.tmp"
        177⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\DA68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA68.tmp"
        178⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\DB43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB43.tmp"
        179⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\DC1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"
        180⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\DCD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"
        181⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\DDC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"
        182⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\DEAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"
        183⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\DF3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"
        184⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\E054.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E054.tmp"
        185⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\E16D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E16D.tmp"
        186⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\E267.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E267.tmp"
        187⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\E332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E332.tmp"
        188⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\E3CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"
        189⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\E48A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E48A.tmp"
        190⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\E536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E536.tmp"
        191⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\E611.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E611.tmp"
        192⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\E6FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"
        193⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\E7B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"
        194⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\E90E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E90E.tmp"
        195⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\E9F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"
        196⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\EAD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"
        197⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\EB8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"
        198⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\EC4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"
        199⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\ED44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED44.tmp"
        200⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\EE2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"
        201⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\EF29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF29.tmp"
        202⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\EFE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"
        203⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\F0DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"
        204⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\F1A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"
        205⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\F294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F294.tmp"
        206⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\F37E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F37E.tmp"
        207⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\F488.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F488.tmp"
        208⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\F553.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F553.tmp"
        209⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\F60E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F60E.tmp"
        210⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\F6BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"
        211⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\F7D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"
        212⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\F8CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"
        213⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\F9A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"
        214⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\FAB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"
        215⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\FB7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"
        216⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\FC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC29.tmp"
        217⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\FCD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"
        218⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\FDA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"
        219⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\FE3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"
        220⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\FEE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"
        221⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\FFB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"
        222⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F.tmp"
        223⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\149.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\149.tmp"
        224⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\1D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D6.tmp"
        225⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\2E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E0.tmp"
        226⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\39B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39B.tmp"
        227⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\466.tmp"
        228⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\531.tmp"
        229⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\5CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CE.tmp"
        230⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\689.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\689.tmp"
        231⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\754.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\754.tmp"
        232⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800.tmp"
        233⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB.tmp"
        234⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\987.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\987.tmp"
        235⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A42.tmp"
        236⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\AEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEE.tmp"
        237⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\BAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAA.tmp"
        238⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\C55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C55.tmp"
        239⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\D21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D21.tmp"
        240⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\DEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEC.tmp"
        241⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB7.tmp"
        242⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63.tmp"
        243⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEF.tmp"
        244⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\10AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10AB.tmp"
        245⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\1186.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1186.tmp"
        246⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\1260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1260.tmp"
        247⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\131C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\131C.tmp"
        248⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\1416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1416.tmp"
        249⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\1500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1500.tmp"
        250⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\15BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15BC.tmp"
        251⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\16A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16A6.tmp"
        252⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\1752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1752.tmp"
        253⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\182D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\182D.tmp"
        254⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\18F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18F8.tmp"
        255⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\19A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19A4.tmp"
        256⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\1AAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"
        257⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\1B78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B78.tmp"
        258⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\1C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C63.tmp"
        259⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\1D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"
        260⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\1DCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"
        261⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\1EC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"
        262⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\1F60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F60.tmp"
        263⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\202C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\202C.tmp"
        264⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\20F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20F7.tmp"
        265⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\21A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21A3.tmp"
        266⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\228D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\228D.tmp"
        267⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\2358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2358.tmp"
        268⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\23F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F4.tmp"
        269⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\24B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24B0.tmp"
        270⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\257B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\257B.tmp"
        271⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\2617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2617.tmp"
        272⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\26F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26F2.tmp"
        273⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\27BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27BD.tmp"
        274⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\2888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2888.tmp"
        275⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\2953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2953.tmp"
        276⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\2A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"
        277⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\2AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"
        278⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\2BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"
        279⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\2CAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"
        280⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\2D7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"
        281⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\2E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E35.tmp"
        282⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\2EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"
        283⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\2F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"
        284⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\3058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3058.tmp"
        285⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\3104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3104.tmp"
        286⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\31B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31B0.tmp"
        287⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\328B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\328B.tmp"
        288⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\3337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3337.tmp"
        289⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\3431.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3431.tmp"
        290⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\351B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\351B.tmp"
        291⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\35A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35A8.tmp"
        292⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\3653.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3653.tmp"
        293⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\36FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36FF.tmp"
        294⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\37EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37EA.tmp"
        295⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\38C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38C4.tmp"
        296⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\3980.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3980.tmp"
        297⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\3A6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"
        298⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\3B26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B26.tmp"
        299⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\3BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"
        300⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\3CBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"
        301⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\3D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D58.tmp"
        302⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\3E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E14.tmp"
        303⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\3EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EDF.tmp"
        304⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\3FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FAA.tmp"
        305⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\4075.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4075.tmp"
        306⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\4121.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4121.tmp"
        307⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\41FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41FC.tmp"
        308⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\4298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4298.tmp"
        309⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\4354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4354.tmp"
        310⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\441F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\441F.tmp"
        311⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\44EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44EA.tmp"
        312⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\45E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45E4.tmp"
        313⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\469F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\469F.tmp"
        314⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\474B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\474B.tmp"
        315⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\4807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4807.tmp"
        316⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\48E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48E1.tmp"
        317⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\49BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49BC.tmp"
        318⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\4AB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"
        319⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\4B91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B91.tmp"
        320⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\4C7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"
        321⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\4D56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D56.tmp"
        322⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\4E50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E50.tmp"
        323⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\4F2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"
        324⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\4FC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"
        325⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\50A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50A2.tmp"
        326⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\516D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\516D.tmp"
        327⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\5228.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5228.tmp"
        328⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\5332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5332.tmp"
        329⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\53FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53FD.tmp"
        330⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\54D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54D8.tmp"
        331⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\55A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55A3.tmp"
        332⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\563F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\563F.tmp"
        333⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\5759.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5759.tmp"
        334⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\5843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5843.tmp"
        335⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\58FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58FE.tmp"
        336⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\59E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59E9.tmp"
        337⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\5AE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AE3.tmp"
        338⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\5B7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B7F.tmp"
        339⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\5C4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"
        340⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\5D35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D35.tmp"
        341⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\5E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"
        342⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\5EFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"
        343⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\5FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"
        344⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\6080.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6080.tmp"
        345⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\613C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\613C.tmp"
        346⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\6217.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6217.tmp"
        347⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\6301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6301.tmp"
        348⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\641A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\641A.tmp"
        349⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\6505.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6505.tmp"
        350⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\65C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65C0.tmp"
        351⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\66CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66CA.tmp"
        352⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\67C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67C4.tmp"
        353⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\68AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68AE.tmp"
        354⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\6989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6989.tmp"
        355⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\6A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A73.tmp"
        356⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\6B3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"
        357⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\6C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C19.tmp"
        358⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\6D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D03.tmp"
        359⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\6DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"
        360⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\6EC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"
        361⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\6F94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F94.tmp"
        362⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\706E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\706E.tmp"
        363⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\7159.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7159.tmp"
        364⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\7243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7243.tmp"
        365⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\739B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\739B.tmp"
        366⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\7485.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7485.tmp"
        367⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\7522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7522.tmp"
        368⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\75ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75ED.tmp"
        369⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\7699.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7699.tmp"
        370⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\7B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"
        371⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\7C65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C65.tmp"
        372⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\7D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D40.tmp"
        373⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\7DEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"
        374⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\7EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"
        375⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\7F72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F72.tmp"
        376⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\7FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"
        377⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\80DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80DA.tmp"
        378⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\81A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81A5.tmp"
        379⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\8270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8270.tmp"
        380⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\832B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\832B.tmp"
        381⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\83D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83D7.tmp"
        382⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\84A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84A2.tmp"
        383⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\854E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\854E.tmp"
        384⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\85FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85FA.tmp"
        385⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\86B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86B6.tmp"
        386⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\8771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8771.tmp"
        387⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\882D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\882D.tmp"
        388⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\8907.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8907.tmp"
        389⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\89E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89E2.tmp"
        390⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\8ACC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"
        391⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\8B69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B69.tmp"
        392⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\8C24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C24.tmp"
        393⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\8CE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"
        394⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\8DAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"
        395⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\8E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E57.tmp"
        396⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\8EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"
        397⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\8F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F80.tmp"
        398⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\902B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\902B.tmp"
        399⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\90D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90D7.tmp"
        400⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\91A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A2.tmp"
        401⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\926E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\926E.tmp"
        402⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\930A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\930A.tmp"
        403⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\93C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93C5.tmp"
        404⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\9471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9471.tmp"
        405⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\950D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\950D.tmp"
        406⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\95D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95D9.tmp"
        407⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\9694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9694.tmp"
        408⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\9740.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9740.tmp"
        409⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\97FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97FB.tmp"
        410⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\9898.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9898.tmp"
        411⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\9963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9963.tmp"
        412⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\9A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"
        413⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\9B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B47.tmp"
        414⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\9BD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BD4.tmp"
        415⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\9C80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C80.tmp"
        416⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\9D1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D1C.tmp"
        417⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\9DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"
        418⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\9EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EC2.tmp"
        419⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\9F6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F6E.tmp"
        420⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\A029.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A029.tmp"
        421⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\A0D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"
        422⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\A191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A191.tmp"
        423⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\A21D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A21D.tmp"
        424⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\A2D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2D9.tmp"
        425⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\A394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A394.tmp"
        426⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\A45F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A45F.tmp"
        427⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\A4FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4FC.tmp"
        428⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\A5A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"
        429⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\A653.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A653.tmp"
        430⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\A71E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A71E.tmp"
        431⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\A7BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"
        432⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\A867.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A867.tmp"
        433⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\A922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A922.tmp"
        434⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\A9BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"
        435⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\AA6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA6A.tmp"
        436⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\AB35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB35.tmp"
        437⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\ABE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABE1.tmp"
        438⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\AC7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC7D.tmp"
        439⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\AD1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"
        440⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\ADA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"
        441⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\AE43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE43.tmp"
        442⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\AEFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEFE.tmp"
        443⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\AFAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFAA.tmp"
        444⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\B065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B065.tmp"
        445⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\B102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B102.tmp"
        446⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\B19E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B19E.tmp"
        447⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\B24A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B24A.tmp"
        448⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\B325.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B325.tmp"
        449⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\B3E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3E0.tmp"
        450⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\B49C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B49C.tmp"
        451⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\B547.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B547.tmp"
        452⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\B5F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5F3.tmp"
        453⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\B6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6CE.tmp"
        454⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\B78A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B78A.tmp"
        455⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\B835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B835.tmp"
        456⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\B8F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8F1.tmp"
        457⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\B99D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B99D.tmp"
        458⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\BA39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA39.tmp"
        459⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\BB14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB14.tmp"
        460⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\BC3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"
        461⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\BD66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD66.tmp"
        462⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\BE8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"
        463⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\BFB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"
        464⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\C0B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0B1.tmp"
        465⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\C1DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1DA.tmp"
        466⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\C296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C296.tmp"
        467⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\C322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C322.tmp"
        468⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\C3AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3AF.tmp"
        469⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\C45B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C45B.tmp"
        470⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\C507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C507.tmp"
        471⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\C5B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5B3.tmp"
        472⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\C63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C63F.tmp"
        473⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\C6DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6DB.tmp"
        474⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\C778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C778.tmp"
        475⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\C852.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C852.tmp"
        476⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\C8EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8EF.tmp"
        477⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\C97B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C97B.tmp"
        478⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\CA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA18.tmp"
        479⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\CAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB4.tmp"
        480⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\CB40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB40.tmp"
        481⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\CBFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBFC.tmp"
        482⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\CCB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCB7.tmp"
        483⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\CD73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD73.tmp"
        484⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\CE0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE0F.tmp"
        485⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\CEDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDA.tmp"
        486⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        487⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\D032.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D032.tmp"
        488⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\D0EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0EE.tmp"
        489⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\D1A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1A9.tmp"
        490⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\D255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D255.tmp"
        491⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\D310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D310.tmp"
        492⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\D3BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3BC.tmp"
        493⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\D468.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D468.tmp"
        494⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\D533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D533.tmp"
        495⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\D5D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5D0.tmp"
        496⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\D69B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D69B.tmp"
        497⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\D766.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D766.tmp"
        498⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\D821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D821.tmp"
        499⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\D8DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8DD.tmp"
        500⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\D9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9B8.tmp"
        501⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\DA63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA63.tmp"
        502⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\DB2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB2F.tmp"
        503⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\DBDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBDA.tmp"
        504⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\DC77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC77.tmp"
        505⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\DD13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD13.tmp"
        506⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\DDEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDEE.tmp"
        507⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\DEC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEC8.tmp"
        508⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\DF94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF94.tmp"
        509⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\E020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E020.tmp"
        510⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\E0CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0CC.tmp"
        511⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\E168.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E168.tmp"
        512⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\E214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E214.tmp"
        513⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\E2C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2C0.tmp"
        514⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\E37C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E37C.tmp"
        515⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\E427.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E427.tmp"
        516⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\E502.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E502.tmp"
        517⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\E5CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"
        518⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\E66A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E66A.tmp"
        519⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\E715.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E715.tmp"
        520⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\E7B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7B2.tmp"
        521⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\E8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8CB.tmp"
        522⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\E977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E977.tmp"
        523⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\EA13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA13.tmp"
        524⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\EAAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAAF.tmp"
        525⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\EB4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB4C.tmp"
        526⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\EC46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC46.tmp"
        527⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\ECE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECE2.tmp"
        528⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\ED9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED9D.tmp"
        529⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\EE78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE78.tmp"
        530⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\EF34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF34.tmp"
        531⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\EFEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFEF.tmp"
        532⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\F0AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0AB.tmp"
        533⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\F166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F166.tmp"
        534⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\F222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F222.tmp"
        535⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\F2ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2ED.tmp"
        536⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\F389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F389.tmp"
        537⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\F425.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F425.tmp"
        538⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\F4E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4E1.tmp"
        539⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\F57D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F57D.tmp"
        540⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\F629.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F629.tmp"
        541⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\F6D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6D5.tmp"
        542⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\F790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F790.tmp"
        543⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\F85B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F85B.tmp"
        544⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\F8F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8F8.tmp"
        545⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\F994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F994.tmp"
        546⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\FA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA30.tmp"
        547⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\FAFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAFB.tmp"
        548⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\FBB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBB7.tmp"
        549⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\FC63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC63.tmp"
        550⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\FCFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCFF.tmp"
        551⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\FD9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD9B.tmp"
        552⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\FE28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE28.tmp"
        553⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\FEE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEE3.tmp"
        554⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\FF70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF70.tmp"
        555⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C.tmp"
        556⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8.tmp"
        557⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\164.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\164.tmp"
        558⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\210.tmp"
        559⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\2AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AC.tmp"
        560⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348.tmp"
        561⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\3D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D5.tmp"
        562⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\471.tmp"
        563⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\52D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D.tmp"
        564⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E8.tmp"
        565⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\6B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3.tmp"
        566⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\74F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74F.tmp"
        567⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\80B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80B.tmp"
        568⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\8B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B7.tmp"
        569⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\943.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\943.tmp"
        570⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\9EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF.tmp"
        571⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7C.tmp"
        572⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\B28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B28.tmp"
        573⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4.tmp"
        574⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\C60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C60.tmp"
        575⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\D2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2B.tmp"
        576⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE7.tmp"
        577⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\E83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E83.tmp"
        578⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\F1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1F.tmp"
        579⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAC.tmp"
        580⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\1039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1039.tmp"
        581⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\10D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10D5.tmp"
        582⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\1171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1171.tmp"
        583⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\121D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\121D.tmp"
        584⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\12D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12D9.tmp"
        585⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\1394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1394.tmp"
        586⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\1421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1421.tmp"
        587⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\14BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14BD.tmp"
        588⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\154A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\154A.tmp"
        589⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\15F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15F5.tmp"
        590⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\1682.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1682.tmp"
        591⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\170F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\170F.tmp"
        592⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\17AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17AB.tmp"
        593⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\1876.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1876.tmp"
        594⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\1932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1932.tmp"
        595⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\1A0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A0C.tmp"
        596⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\1AB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AB8.tmp"
        597⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\1B45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B45.tmp"
        598⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\1C10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C10.tmp"
        599⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\1CAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CAC.tmp"
        600⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\1D77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D77.tmp"
        601⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\1E42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E42.tmp"
        602⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\1EEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EEE.tmp"
        603⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\1FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FAA.tmp"
        604⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\2056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2056.tmp"
        605⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\2102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2102.tmp"
        606⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\21BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21BD.tmp"
        607⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\2259.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2259.tmp"
        608⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\2315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2315.tmp"
        609⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\23D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D0.tmp"
        610⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\247C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\247C.tmp"
        611⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\2547.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2547.tmp"
        612⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\25F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F3.tmp"
        613⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\268F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\268F.tmp"
        614⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\275B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\275B.tmp"
        615⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\2826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2826.tmp"
        616⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\28E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28E1.tmp"
        617⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\299D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\299D.tmp"
        618⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\2A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A58.tmp"
        619⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\2B23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B23.tmp"
        620⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\2BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BDF.tmp"
        621⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\2C8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C8B.tmp"
        622⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\2D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D37.tmp"
        623⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\2DB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB4.tmp"
        624⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\2E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E6F.tmp"
        625⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\2F59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F59.tmp"
        626⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\3053.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3053.tmp"
        627⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\312E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\312E.tmp"
        628⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\31DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31DA.tmp"
        629⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\32B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32B5.tmp"
        630⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\3380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3380.tmp"
        631⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\340D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\340D.tmp"
        632⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\3499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3499.tmp"
        633⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\3564.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3564.tmp"
        634⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\3610.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3610.tmp"
        635⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\36BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36BC.tmp"
        636⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\3749.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3749.tmp"
        637⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\37F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37F5.tmp"
        638⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\3891.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3891.tmp"
        639⤵
        
        PID:6584

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2144
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

10BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\10BF.tmp
Size 652KB
SHA256 4fe43e2038f0f81cdc1c8ff9b73fc71d6d8f3ceab8c8414d607402f46cf31f0f
MD5 c78c0361e81fb116bae4a19413ffd563
SHA1 3113e1ed5a6e188b54f60a07acad19676fd891bf
SHA512 2d753b42173a2f86f88368c11c4ce06863aadbc7d26e6378c61908b75931b390c4051c23ae17fee65912ebf4fd2a1d923e3895500a792c943471a1f387af00d1
SSDEEP 12288:wU5rCOTeiDJxpmg7Dh0KXms6jI0qSDOoMRfYNZ+3/v+I9hUG2VA:wUQOJDJxpmg/WC6jI05jMFYNGEA
TLSH
T1C2E4D12173D88532E6FB037859B5A6614D7EFD326722D6DF2F80126E1A71BC09A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1275.tmp

Path C:\Users\Admin\AppData\Local\Temp\1275.tmp
Size 652KB
SHA256 e10a09a42188621d2374f3d0f37dd9bff1c61af014fbd61b4c6f354dcc047038
MD5 f7f17680f77a30f92ef14b339f2d7c11
SHA1 d1c5d3dc3c5d809abadc08027b316d82dee55fbf
SHA512 3e5bf177ff780c2c7779543975082e584b210f9eae16b2b54290f500b6b7dfba5bb6ed177aedbeca4f01870524682fdb018f0976039c1d42fac39905415f704d
SSDEEP 12288:wU5rCOTeiDTRMnx5ov2TnB5OZpEbNZ+3/v+I9hUG2VA:wUQOJD2HvN58cNGEA
TLSH
T11FE4E12077D88132E9FB037859B5E6614D7EBD366722D6CF2F8016AE09B1BC09631763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1459.tmp

Path C:\Users\Admin\AppData\Local\Temp\1459.tmp
Size 652KB
SHA256 03a20452044f371d4e2bdb72a71933b875adbdbee3518bf99d85ab8c67eae1cd
MD5 87983f7e36db5b94da87302ed682bb13
SHA1 cebe2103bd460289c541d37e39af098194adde9a
SHA512 d0156efa58e51b2b4c442743516b0dad60d9d14e767ec5d1a295ddfa32f05f5317597c7afbc773bf4b464dcb785dab3b73f812e3afa59735eea62cc6688d3f0d
SSDEEP 12288:wU5rCOTeiDN1F7wT4rjb31iGS5Bf35NZ+3/v+I9hUG2VA:wUQOJDN1F7wkjb3a5Bf35NGEA
TLSH
T123E4E12173D8C532E5F7037859B5E6614D7EBD32A722D6DF2B8016AE0AB1BC08671723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\16BA.tmp
Size 652KB
SHA256 f82004abde32740ebb365f5d397239d940fca5c90a91f936dd87e44284fbcca4
MD5 68a075da629913a42db76e0f6853b1ad
SHA1 be97b89b2abc5054fef3759f756449cd0e98ef12
SHA512 e6e7631646acb29ff037fe7c90103625b3da5fa1638077c3dbc9101abf9b8f00b1d351dde56f01f2cbb59d0b855d1bbfc0e9ec2caf1b1d5fe9e5d79a4b3fae83
SSDEEP 12288:wU5rCOTeiD41J+mGVH0bhSKzrae1v5g86Q6xNZ+3/v+I9hUG2VA:wUQOJD41J+mGH0bhSKXVZfQNGEA
TLSH
T190E4D02077D88536E9F7037859B5F6504A7EBD36A722D6CF6F8012AE49B1BC08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

197A.tmp

Path C:\Users\Admin\AppData\Local\Temp\197A.tmp
Size 652KB
SHA256 734d405338f3565153a5a8e6efb765c5567c793885339e837eaaef77734e6594
MD5 e50be2ab6643312c741911e7c296e8bb
SHA1 35b4779a84e30bf4fe9c65299745570ca5f17d23
SHA512 35686b58e8c6e552aa10d16187ae6f92e3e517ed39ad0a939e04c0196715db0cee91796fbb7d817649a77c86fc9ae409f1a92154dc61c17f9027463f8a53c2de
SSDEEP 12288:wU5rCOTeiD8hpE2LAuu/ij4+WOfvTX2j+YNZ+3/v+I9hUG2VA:wUQOJD8h7VQ+WMDA+YNGEA
TLSH
T142E4E02177D88636E5FB037859B5E6604E7EBD326722D6CF1F8016AE09B1BD08A31713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\1BDB.tmp
Size 652KB
SHA256 e1ccdd36a9a78976a9301411975aa02445d3ce2fdc7cca679f300e99b7c83fc9
MD5 582cb2030bf09c29585465fb72092280
SHA1 0438508fff74414583f9e6a4e2e4913d6941841b
SHA512 43179889eb02ee14d9dbfcb9d4ee35393d9f7eb9ab7fb17be88fa6594a0ef398d1ba717223bd46f8f81f58bbd11401b9c2ed18d3a4c3ddd5e152dab32ae55955
SSDEEP 12288:wU5rCOTeiDe12+pXWYogNAL7ZciHrONZ+3/v+I9hUG2VA:wUQOJDM2+pRNNALlvCNGEA
TLSH
T1C8E4D02177D88636D5F7037859B5E6604D7EBD326722D6CF2F8016AE0AB1BD08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1DB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\1DB0.tmp
Size 652KB
SHA256 e93c686e68e7df0c43b4b6b4318d05453f5f946b4e5f468a9db2d7e126abf708
MD5 c7123d959f6b49307e7b6418379533e0
SHA1 acf92df7ecca8779b4d16bdad5d1499a044659c0
SHA512 b037192bd65fc7a70a918ebe4db5335478f6b75af0d06170077f69ff4a8fad9504e6456acad26be3728beda7cb0a66695a5435476e1972d42a7d3d3071ddd745
SSDEEP 12288:wU5rCOTeiDv7f9TlR1CcHowiqNZ+3/v+I9hUG2VA:wUQOJDzf9L1CcIhqNGEA
TLSH
T176E4D02173D8C536E5FB037859B5E6614D7EBD225722D6CF2F8026AE09B1BD08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F94.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F94.tmp
Size 652KB
SHA256 14cac247d43e3065404b1379f70d3257c9790f847886053094d4867b76e46bd1
MD5 68cdf5a63b665f60ba10e8290b46682d
SHA1 b531e01063363256013169ebbfdfdcf15eeb61ae
SHA512 9515042c16d8e971ee34143a133f3ae8bd067d2206ad5f66c9cac024b25e8cb8c3f74ae08dcf586e664e4b0e9a023a41c17982a9f3e38ce5a9a9c5e5526c1d74
SSDEEP 12288:wU5rCOTeiDlEDLj8MZ/xtaDaYuFEU2RS6NZ+3/v+I9hUG2VA:wUQOJDKDUMZ/xthYuWFS6NGEA
TLSH
T17EE4D12173D88632E5F7037859B5E6614D7EBD36A722D6CF2F9011AE09B1BC08A71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2169.tmp

Path C:\Users\Admin\AppData\Local\Temp\2169.tmp
Size 652KB
SHA256 55553682b74acf380112e182e19917b252f22aba4a0ddade5dc283c4076727ba
MD5 add709582ce54ca284aa75cd9cff0588
SHA1 ae66d1cef9bb8baaeccceeaa8b42e4fbccf73feb
SHA512 2d4ef1f2acb9d56fbb086b03810b9ea6b8efb066c685b008fb8a58288e8fd8ac4c51120ff66ad8a65c74bf06e04bbae84e0bbdfdbc2c8d3e2eca9b651fc88243
SSDEEP 12288:wU5rCOTeiDXO8OAHUuE/hni6nBFNZ+3/v+I9hUG2VA:wUQOJD7ZpQhnPBFNGEA
TLSH
T10EE4D02177D8C532E5FB037859B5E6614D7EBD226722D6CF2F8025AE09B1BC08A71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219.tmp

Path C:\Users\Admin\AppData\Local\Temp\219.tmp
Size 652KB
SHA256 b1e40bf4dbaff988a948e7dfa41ba5a40570a7efbd3cae17e6f7b80e9395dc06
MD5 20013e0fb72986ce83367eb0fdffb3f7
SHA1 3da0d19ec1c653e59410c45afeffc732a7b4d5fd
SHA512 067047f859db304e4dd4ef5849d49620059be81374fad98a6cea8f710fba4f10ecbc7d3c6cfc8eee359af8880901187589bd6501cd543ca01aac2840da6bae5c
SSDEEP 12288:wU5rCOTeiDeCG26r8N/Eh3sESaWQVj8U0eDNZ+3/v+I9hUG2VA:wUQOJDeCG2S1koj81eDNGEA
TLSH
T1CEE4D02173D88636E9FB037859B5E6614D7EFD226722D6CF6F9012AE0971BC08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\23AB.tmp
Size 652KB
SHA256 a1756353f41c2f6d3c2308dc9409b3a309e1ea81b60ed333866417a490595160
MD5 23560c86b23c38739d04a4a5b4c442e5
SHA1 22fb9536124f283bdef05119fd4ee1cc6bc8039c
SHA512 3da1ce764722b8a5952b7baad6906ca6f1cb35f4d14606354fe4693873eef2fc5fcbf0ff2300686836c1842bbfc39f2738f230db985b39ebd714c4fe0a747532
SSDEEP 12288:wU5rCOTeiD+2XGc24jA+u6E7NXnbiljyj8NZ+3/v+I9hUG2VA:wUQOJD+2M+87htoNGEA
TLSH
T120E4E02073D88536E5FB037859B5E6614D7EBD369722D6CF2F8016AE09B1BC09A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2541.tmp

Path C:\Users\Admin\AppData\Local\Temp\2541.tmp
Size 652KB
SHA256 d71e4241c9390d64fd59894c3a207ae95ca25cd199b2a997f10b27d387ca0331
MD5 a376080902ab518f0efcbffbdfa0d63b
SHA1 7aaedd6d17f0585ecb34e0873bc2ba79d0ea4682
SHA512 528ed2412a7fa0c837123ff1ede3d278175d2bce8a8d0a07464739f929f64d5a8c65d5339259f15b1685246d558e1cf8fecff95ecc6b2e5317108b411302d4c5
SSDEEP 12288:wU5rCOTeiD6+6oO1iR6CMg+UTUHt5KnKw9vK7rkNZ+3/v+I9hUG2VA:wUQOJD6+6F15gXTUNPw9ukNGEA
TLSH
T1A4E4D02173D8C532E9F7037859B5E6644A7EBD326712D6CF6F8012AE09B1BD08A31763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2764.tmp

Path C:\Users\Admin\AppData\Local\Temp\2764.tmp
Size 652KB
SHA256 98026e79ff6a1fa0070d80eb915d0ab93c57dad6d582d0c966a3e1474a396444
MD5 39de9e7f2e82b2ef7d98c7766a796551
SHA1 bbfd4d2f943dfd565e15d07fc8ef71bfe4272690
SHA512 86a5b4837ae0c2dcee4910ede94e3e913dfe799b5f9a12b1bbd813324d0e5debb5571d2218f447bb54b8b5f9f00d975932131be3505d9af1397d5f0b8096c155
SSDEEP 12288:wU5rCOTeiD/ONx9c34PMAWaXqR/NuuVa/NZ+3/v+I9hUG2VA:wUQOJD/ONxexAyuW8NGEA
TLSH
T195E4D12173D8C536E5FB037859B9E665497EFD36A722D6CF2B8011AE0971BD08A31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

290A.tmp

Path C:\Users\Admin\AppData\Local\Temp\290A.tmp
Size 652KB
SHA256 0f4df547c7f33789af34372227c7af12ea8241ec8ae3f2038ed8bdd243d7b907
MD5 54fc0e8ff413734ca5360e0672c8c297
SHA1 c1bd7ec0899d0bd815d7d631d8e4ed8c23591d62
SHA512 ad700bb34c7be196646b540e754f653733aab3a0891e16645124444f6a3b304b80052ecdd22f74964d23808073b7019665e43e96f9dc0258f1238f9a6180afd7
SSDEEP 12288:wU5rCOTeiDmeUht1Yw5kAYNqF7EQibMSRQbPsCkwpNZ+3/v+I9hUG2VA:wUQOJDmJhlkvqBibMSQP2YNGEA
TLSH
T141E4D12173D88532E5F7037859B5E6614D7EBD26A722D6CF2F8056AE0A71BC0CA31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2C36.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C36.tmp
Size 652KB
SHA256 23ac2d85932b77b132a95e0a9ef31f6830c686fbab55f49685273663cf53feac
MD5 ec56aca1b855df56774149e7e1b105ab
SHA1 c353979584543760aff5127f0e35f80b1961f93f
SHA512 c5f2432a52277d911e681760509b7d5ba438512d1f9f81c8172b3b63d3164023ee9a87fddfea9ca4fa58f07eb6fffa58bc0e33451207402a10b607dd5ed7a465
SSDEEP 12288:wU5rCOTeiDfy8dgJ0LuPuS0XdRoefmlVioCLVXNZ+3/v+I9hUG2VA:wUQOJDaJ0i61fmlVioENGEA
TLSH
T15AE4D02177D88132E5F7037859B5E6644E7EBD32A722D6CF6F8015AE1AB1BC09630723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2EF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EF6.tmp
Size 652KB
SHA256 51a49b151aa6a065e2b5ac116da99ad0e912e3edf7d6591fb90b81842636c36b
MD5 a4dcf5b524e3fb7042095e5430c2dbca
SHA1 46e196b331567757a0b34a8bed9f621e65d69175
SHA512 836cd988da2c404e819d7f708c0308a76d7f41758524ede1eb981261027304546fbef65f3b14e3cb94d9be12e8f758825b44400fea978dc74ff2fde492d9c0a0
SSDEEP 12288:wU5rCOTeiD6/mkvbzik6DWHtvHGHTpT21wLMrNZ+3/v+I9hUG2VA:wUQOJDUik6DotvHGHTE+MrNGEA
TLSH
T1C5E4E12173D88532E5F7037859F5E6654A7EBD226722D6CF2F8016BE09B1BC08A71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3109.tmp

Path C:\Users\Admin\AppData\Local\Temp\3109.tmp
Size 652KB
SHA256 67e29ed53f6b5d0de96c47ac101c3cc2ff559be2d5f915a81c690cdd223601e2
MD5 ad34204ec4d95e2ea98d44fb07db0f70
SHA1 953f6ffc5ee9d8ae6c4e5ca011cf37c415911bda
SHA512 5599adb50d6cf3d1168f785e4a3b9c6b8ec685eecff169978e10e5e55f84a7d121ab7674995751bd1488c9b6bfe7887aefc1f5fbadecfc7d867f67a62962dd7d
SSDEEP 12288:wU5rCOTeiD9jgV82Ah1aEh1gnYgs1MNZ+3/v+I9hUG2VA:wUQOJD9kV8dh1aEjsDNNGEA
TLSH
T1E5E4D02177D8C532E5FB037859B5E6614D7EBD22A722D6CF2F8012AE0971BC09A71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\33B8.tmp
Size 652KB
SHA256 ffada729589c6ea4fa6c7dbcb8d07ef27b5e8ea351b94ed6a25636e118a2ea1f
MD5 812cf71fa8937aeeff7873598f9f3cbd
SHA1 95531d929a748e586ac2d73d01383ad1f1312a69
SHA512 5ca534ce5e8ee55adc293a43848d8b773e203c846fe136304a443324a7dffb7d8555e1239ef6b2e95d079dff006e8760c48dd9ee2c0eb774f6015001d8e95dd9
SSDEEP 12288:wU5rCOTeiD5cxyVAmTcA0O8JVh2Zl5dNZ+3/v+I9hUG2VA:wUQOJD5cqAmBxZZNGEA
TLSH
T124E4D12173D88632E5FB037859B5E6514E7EBD326722D6CF2F8016AE19B1BC08671723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\35DB.tmp
Size 652KB
SHA256 94374cccc59e7dc89c779d51722bd1579110693182d75939c2e825c26505533a
MD5 63779cff081a0a705b2d8325fb003224
SHA1 0a2cf22ef689cc65c95a87f1e4afb01a39d5b707
SHA512 dfcd41865a966398ae3ab48f18e4de04955535dcb7551e143902d6bcd2d2f8c28e4c245c34decb45e92848eb62e126d330d64218090dc12bbc5867010d763712
SSDEEP 12288:wU5rCOTeiDOPFHnp03U+VARNixEOeleNZ+3/v+I9hUG2VA:wUQOJDcHq3UYo5eNGEA
TLSH
T100E4D02077D88532E5F7037859B5E6604D7EBD326B22D6DF5F8012AE19B2BD08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44C.tmp

Path C:\Users\Admin\AppData\Local\Temp\44C.tmp
Size 652KB
SHA256 6606ca96ebd074f2893cce9720c0d238bbab877eeedb19a097fa7c319b153186
MD5 6e04b6ff9c1938995d6078447546495a
SHA1 0cfc2a6bff7e97907125e5ce0a4dc089a0121ed5
SHA512 5cea320fdbe30a50d5ca6ee07237b170c12b525f2b45e81215892e005396ba00375161124353b82d7f59c8253e79f5f3ebfb59485862599b8a2e53dd50682a59
SSDEEP 12288:wU5rCOTeiDOtnQfj0PysbhWtNZ+3/v+I9hUG2VA:wUQOJDOtnQIPyahWtNGEA
TLSH
T1B7E4E12173D88532E9FB037859B5F6614D7EBD26A722D6CF2F8411AE1971BC08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\5E2.tmp
Size 652KB
SHA256 402ba0d9dd39555f0f7b5fd8df88f8e80bb39245efcbdb66dc0caf1e59d57868
MD5 d419a91cb64835eed3d2582eded1fd9c
SHA1 fa0798a1bb9c9aa1f5318f4df273e2c9e55f2b59
SHA512 9c66c2c97e8ca1949f2685fee590ad9e61cc1dc4b8a885bf81203a8dacfe19adb2f2220f8d421debbb6fff836e96337893afa29f2d0922b2b507fd8e4b968432
SSDEEP 12288:wU5rCOTeiDWZEIypCNHuuhz6AOHq8qYNZ+3/v+I9hUG2VA:wUQOJDCFHuHDK5YNGEA
TLSH
T1BFE4D02173D88632E5FB037859B5E6654E7EBD326722D6CF2F8016AE0971BD08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\7F5.tmp
Size 652KB
SHA256 ae74cc34131f4bdf0b126c542d7ad15432cd7636e86f916e3df421565259f0ff
MD5 7e2678426fdb974b5ebb008032a8bb2c
SHA1 04351b329acfe00af2c765d5479e91773dee4a6a
SHA512 ee3df8d0c754b8253d3d4785a51a89c36b7a3a8d39f70a50f52fd84afb9e568a359ba8b2f7dff91aba400398c076efe230725701b1d2649cd463386e6cb90aed
SSDEEP 12288:wU5rCOTeiDdC01TCs7VpNNcZnWqFNPNZ+3/v+I9hUG2VA:wUQOJD801f7VpgZnNJNGEA
TLSH
T1F7E4D02173D88536E5FB037859B5E6614D7EBD32A722D6CF2F9011AE09B1BC08A71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A08.tmp

Path C:\Users\Admin\AppData\Local\Temp\A08.tmp
Size 652KB
SHA256 1517cccae15a2bf13c81dbdb1d832131b779ab1e54ecfdb796fd82e2dd2d8ce5
MD5 edf458bb466b17f6a3a47717f50cb9fb
SHA1 854f2e60cd9a58115b7dbbf01742f287362bf6a3
SHA512 eaa0368bdbf63c7ba36f89d09bb019fb977ab657e62fc19f7b0d3c616de9836bbd5a27f253ca1c4771fbb1a8b5a616441910de4992bda21668aa782ca5d5c1ad
SSDEEP 12288:wU5rCOTeiD5gfkzhRLmW7JnmvIe4tarRS2NZ+3/v+I9hUG2VA:wUQOJDCahRLivGgrI2NGEA
TLSH
T16DE4D02177D88532E5F7037859B5F6614E7EBD22A722D6DF2F8016AE09B1BC08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\C5A.tmp
Size 652KB
SHA256 68825f5197b36010d012e13daa15b890de651efece2dd4e80fd6cdb5897d5974
MD5 fc805dbd9c92a1e6258f198ffe532404
SHA1 4ed39f21216cca0aee3ff7528b328924bfd6c765
SHA512 3979fbd2eec4e2e617694c706bfcfeaec443ff3ad3aaa8e484d4edbe732826ef53735e339dbfe5dc2bd388c542eb4ecba88212ea0135f65567308196cf800f84
SSDEEP 12288:wU5rCOTeiDYTvrZ8ludnrkzmpQ7tNZ+3/v+I9hUG2VA:wUQOJDcvrZ5nmm8NGEA
TLSH
T15AE4E12173D8C532D9F7037859B5E6604D7EBD22A722D6CF6F9012AE09B2BD09631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\DB2.tmp
Size 652KB
SHA256 c352de3c3f1c50d804c21bf76fc472997d8f4477a269d891e78fbd79a492382f
MD5 f60e6eb4da572644e8edbd6a4c94fe18
SHA1 23be588286be66b7e941908511e60b7bf9ce8bfa
SHA512 f611b6abeeed6c787206fcff7b674d5859f2b75dd4b6e4ad40f8153ed779dbaa90ab874a02fce14f607fb093ef0956210515ba9dda6e5c8a54853a7b22325ca5
SSDEEP 12288:wU5rCOTeiDApX1po0nSho7UfwAR3gtZy+ENZ+3/v+I9hUG2VA:wUQOJD8XfokSxfwA+trENGEA
TLSH
T1FEE4D02173D88532E9FB037859B5F651497EBD326722D6DF2F9025AE09B1BC08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F008.tmp

Path C:\Users\Admin\AppData\Local\Temp\F008.tmp
Size 652KB
SHA256 d3244d5bc49f6575e0a6ab85bf7c8738d0d490a5f1c6846bddd1c656738077cb
MD5 df572adf391dbf4828fd85ec4c024a42
SHA1 16d01858b63197298ef10b6edd5f054ba99ca42a
SHA512 2c12ebf8582605c83cc23381a5d683d3994d01b06fdc2c2bf9df7933909c1005cfb27eb9a7d460e18c67c482afcbae5de326c4bcced8d7bcd95a1d6f6576dee6
SSDEEP 12288:wU5rCOTeiDZeh1nwe6JkemzLnXOYrgsN/LjifUrNZ+3/v+I9hUG2VA:wUQOJDZeh1nKJknzLe4gslLWsrNGEA
TLSH
T1D4E4D02177D88536E5FB037859B5E6654D7EBD32A722D6CF2F8015AE09B1BC08A30723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F325.tmp

Path C:\Users\Admin\AppData\Local\Temp\F325.tmp
Size 652KB
SHA256 98797951cf1f81f2c857ec55942a0ba8c781272aff875cf963e4949c82a97cb8
MD5 8480fcbb480681350db61f5eed80c14c
SHA1 db1252684d8b5c57ddcebcc12d07382fbe4ec8d2
SHA512 ff31018e51fc031eb4ebf511f1fd4e959e0e742724f35ea18d5d1c10c26b46d9d7488f6d7a1912917da31136c0379a3e20304da732aff1a4332b2e5d8db5a7cf
SSDEEP 12288:wU5rCOTeiDWFrgQe6tEN2UYYGi98q9BNZ+3/v+I9hUG2VA:wUQOJDWVgQes4QNihBNGEA
TLSH
T196E4E12173D88536E5FB037859B5E6604E7EBD326722D6DF2F9025AE0971BC08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F671.tmp

Path C:\Users\Admin\AppData\Local\Temp\F671.tmp
Size 652KB
SHA256 2169bff0421360bf091e516725327f565078cb1e46a8406c51eec7ffe809139f
MD5 480d55aff6b50407304721357754eb7e
SHA1 268bd4536fb0fc7df84362fef501f9e3b26c9a52
SHA512 08a4aa40c337ebc1270c0abc2b990766d1023a3d04b6a8a29b099f9e1c3573b10a6be4319e425de5866970ac961ce65db68976b8ca2294f2701d5423f39b0fce
SSDEEP 12288:wU5rCOTeiDZJx2clQ0YPv3ZNHlS4NZ+3/v+I9hUG2VA:wUQOJDfPyvztNGEA
TLSH
T13BE4D02073D88532E5FB037859B5E6604D7EBD366722D6CF6F9012AE09B1BD09A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F894.tmp

Path C:\Users\Admin\AppData\Local\Temp\F894.tmp
Size 652KB
SHA256 c883c4c3d78de3543d668f19818d7b866ca1d9b64219c7f4a7474a8792f0151f
MD5 14820cc97055e78fdfc4e1964c3577b2
SHA1 a1b38e8842a1b0f247e350ba9fe2473fdd23367c
SHA512 00edb0797e6df76ec39f63e79c58488a112460063bfd624a0ed2e63dd218371cb512fdf59cd9a13874edeb541d54362c5954ca48df6c0c34d62331ccdcd7aa37
SSDEEP 12288:wU5rCOTeiDgpnkk5O+fzIN9nGlyluq0NZ+3/v+I9hUG2VA:wUQOJDgpnZ7fzAnPt0NGEA
TLSH
T136E4D02177D88532E9FB037859B5E6604E7EBD326722D6CF6F8012AE1971BC09631723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FAC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\FAC6.tmp
Size 652KB
SHA256 8036f22bb02452c5dda7df62759e691dc52110b3a38c00b730eacff00df7573e
MD5 5b2eb25fedf21d998691f7c10775753b
SHA1 989a4e5aff234ffd9c2eadbbbe69be34fd989a1e
SHA512 dd289c5db104c6fe857f09820b060f84c918fcc3af8fe7a335fdca44c3b125f81610f8cbcf35ce884aae8bee8980a2c141ca3bbdcd5653b31d6a53ea3231c64f
SSDEEP 12288:wU5rCOTeiDJlGinpqYkcEidoUN8NZ+3/v+I9hUG2VA:wUQOJDJAApDkcxTN8NGEA
TLSH
T184E4D02177D8C632E9FB037859B5E6615D7EBD226722D6CF2F8012AE09B1BC08571723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FD56.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD56.tmp
Size 652KB
SHA256 8d8e578b149f3072242120ebc781d34d68602120eaf848f7a541e3f480931149
MD5 58824984b4aaa4c87685b2d199f50cf7
SHA1 aca480ff85c65798bac6b3a2401af547dc74780c
SHA512 755508a4f1d3b62a5958c6b7bcd38649c84154844320fcdf3014fb4bb839abf1426fddd23007d7db43b7a8855a67559834fb014a765cc13e913617013d11b80b
SSDEEP 12288:wU5rCOTeiDc44agYu7TubjklOj2EuNZ+3/v+I9hUG2VA:wUQOJDwYKKglOjDuNGEA
TLSH
T155E4D02173D88536E5FB037859B5E7654E7EBD226722D6CF2F9011AE09B1BC08A31723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FF89.tmp

Path C:\Users\Admin\AppData\Local\Temp\FF89.tmp
Size 652KB
SHA256 4e4e6dfe28e2bb9b245e8908f85a69103c22bcb114f4f45bc5974d5ca7e215ab
MD5 ea0924d8994a635d6b65d3d70d184d29
SHA1 40711d652ed738edf87f0d4846cfd9ecafb122f3
SHA512 8c81b7d54516a4f2ea0d7150c2b23ca917faaeda36e193e7d9dd56d0d48b25ae8f482fc5d38eedf738df23304ea575c254f5cd380456c19015404baa87ad7050
SSDEEP 12288:wU5rCOTeiDbFNorjZpbXxPvEE32Y9NZ+3/v+I9hUG2VA:wUQOJDpNIpzx3f379NGEA
TLSH
T131E4D02173D88536E9F7037859B5E6604D7EBD32A722D6CF6F8021AE09B1BC09671723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/348-173-0x0000000000FB0000-0x0000000001033000-memory.dmp

Download

memory/348-182-0x0000000000FB0000-0x0000000001033000-memory.dmp

Download

memory/616-222-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/616-229-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/708-5-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/708-13-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/724-215-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/724-210-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/956-19-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/956-12-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/1016-1118-0x0000000008CF0000-0x0000000008D54000-memory.dmp

Download

memory/1040-203-0x0000000000580000-0x0000000000603000-memory.dmp

Download

memory/1040-194-0x0000000000580000-0x0000000000603000-memory.dmp

Download

memory/1056-133-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1056-124-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1368-243-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/1368-239-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/1532-103-0x0000000000290000-0x0000000000313000-memory.dmp

Download

memory/1532-112-0x0000000000290000-0x0000000000313000-memory.dmp

Download

memory/1564-160-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/1564-152-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/1732-195-0x0000000000BC0000-0x0000000000C43000-memory.dmp

Download

memory/1732-187-0x0000000000BC0000-0x0000000000C43000-memory.dmp

Download

memory/1844-96-0x0000000000DA0000-0x0000000000E23000-memory.dmp

Download

memory/1844-104-0x0000000000DA0000-0x0000000000E23000-memory.dmp

Download

memory/1872-47-0x0000000000560000-0x00000000005E3000-memory.dmp

Download

memory/1872-56-0x0000000000560000-0x00000000005E3000-memory.dmp

Download

memory/1896-303-0x0000000000B10000-0x0000000000B93000-memory.dmp

Download

memory/2008-70-0x00000000005C0000-0x0000000000643000-memory.dmp

Download

memory/2008-61-0x00000000005C0000-0x0000000000643000-memory.dmp

Download

memory/2148-209-0x00000000009C0000-0x0000000000A43000-memory.dmp

Download

memory/2148-201-0x00000000009C0000-0x0000000000A43000-memory.dmp

Download

memory/2372-264-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/2372-258-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/2412-278-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/2412-284-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/2424-167-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/2424-159-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/2452-118-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2452-126-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2756-253-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/2756-259-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/2844-33-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/2844-41-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/2920-928-0x000001FD83CE0000-0x000001FD83D00000-memory.dmp

Download

memory/2920-939-0x000001FD83D20000-0x000001FD83D40000-memory.dmp

Download

memory/2920-913-0x000001FD801E0000-0x000001FD802E0000-memory.dmp

Download

memory/2920-958-0x000001FD84260000-0x000001FD84280000-memory.dmp

Download

memory/2920-929-0x000001FD83F70000-0x000001FD84070000-memory.dmp

Download

memory/2956-244-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/2956-249-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3136-298-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/3260-82-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/3260-91-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/3528-34-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/3528-28-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/3584-238-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/3584-233-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/3756-254-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/3756-248-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/3772-26-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/3772-21-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/3868-228-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/3868-234-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/4064-40-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/4064-48-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/4084-294-0x0000000000830000-0x00000000008B3000-memory.dmp

Download

memory/4084-288-0x0000000000830000-0x00000000008B3000-memory.dmp

Download

memory/4268-145-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/4268-154-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/4300-174-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4300-166-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4400-89-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/4400-98-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/4524-269-0x0000000000B10000-0x0000000000B93000-memory.dmp

Download

memory/4524-263-0x0000000000B10000-0x0000000000B93000-memory.dmp

Download

memory/4536-140-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/4536-131-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/4668-76-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/4668-68-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/4716-63-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/4716-54-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/4772-268-0x0000000000FA0000-0x0000000001023000-memory.dmp

Download

memory/4772-274-0x0000000000FA0000-0x0000000001023000-memory.dmp

Download

memory/4856-273-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4856-279-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/5044-6-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/5044-0-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/5116-224-0x0000000000380000-0x0000000000403000-memory.dmp

Download

memory/5116-217-0x0000000000380000-0x0000000000403000-memory.dmp

Download

memory/5228-189-0x0000000000B60000-0x0000000000BE3000-memory.dmp

Download

memory/5228-180-0x0000000000B60000-0x0000000000BE3000-memory.dmp

Download

memory/5408-283-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/5408-289-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/5756-75-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/5756-84-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/5852-138-0x00000000007C0000-0x0000000000843000-memory.dmp

Download

memory/5852-146-0x00000000007C0000-0x0000000000843000-memory.dmp

Download

memory/6064-299-0x00000000002B0000-0x0000000000333000-memory.dmp

Download

memory/6064-293-0x00000000002B0000-0x0000000000333000-memory.dmp

Download

memory/6140-119-0x0000000000250000-0x00000000002D3000-memory.dmp

Download

memory/6140-110-0x0000000000250000-0x00000000002D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads