b24f829de5ded4d334f0aa35c04775b3333cd73b9b48816e6d9c7d18a4091f4e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_5c0f14c415f600887ee729f63218c57f_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260724-2cjqaat1bx
SHA256 b24f829de5ded4d334f0aa35c04775b3333cd73b9b48816e6d9c7d18a4091f4e
MD5 5c0f14c415f600887ee729f63218c57f
SHA1 439e3026872f8b2c6cc7a3886dfa9e84babc042a
SHA512 2faf18b0f496e8c193bab1974f0046fde997a699cfc669946f8086942fd05b1ab904475746a7945a1c68ca8e66b65c4721f78c9e9404405120b8a66f555cb212
SSDEEP 49152:w/OJDy71UwjNGEADt7i+/yTukuFGNLrkBirx:EOGjchrSiGdkBirx
TLSH
T11906831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1300	649C.tmp
2620	6596.tmp
5148	6AE5.tmp
2500	6ECD.tmp
5916	7267.tmp
2552	75E2.tmp
3088	7872.tmp
2592	7B70.tmp
3484	7E4E.tmp
5968	811D.tmp
2844	83EC.tmp
3128	86E9.tmp
3600	88CE.tmp
5924	8B7D.tmp
3056	8E1D.tmp
5264	90FB.tmp
5588	94B4.tmp
1732	9793.tmp
5808	9A62.tmp
5632	9D11.tmp
960	9FC1.tmp
2916	A241.tmp
2852	A520.tmp
1676	A7A0.tmp
2904	A8F8.tmp
3900	AC63.tmp
1276	AE18.tmp
1108	B01C.tmp
2376	B210.tmp
5864	B51D.tmp
3464	B675.tmp
3804	B7CD.tmp
2432	BCAF.tmp
1116	BD99.tmp
5820	BEA3.tmp
5780	BFCC.tmp
5080	C0E5.tmp
2480	C21D.tmp
6012	C346.tmp
5860	C450.tmp
4400	C569.tmp
4444	C663.tmp
4472	C71F.tmp
5980	C7BB.tmp
4676	C857.tmp
3284	C922.tmp
1772	CA4B.tmp
4712	CB64.tmp
4688	CC20.tmp
4408	CCCC.tmp
4212	CD97.tmp
5320	CE33.tmp
3124	CEDF.tmp
1412	CF7B.tmp
4388	D056.tmp
3212	D131.tmp
992	D1EC.tmp
5260	D298.tmp
4856	D373.tmp
4892	D46D.tmp
1072	D5A5.tmp
3240	D651.tmp
3184	D6FD.tmp
4776	D7E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E0AD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F19.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C14.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9566.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ABEC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9FC1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC20.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DDDE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E0B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E4E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D6FD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1FBE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2B95.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DBA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A663.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	774F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A90E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B7D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E1D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2452.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8704.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D63D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAC1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F8A9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B66.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C663.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CE33.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3941.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DD3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E2F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9924.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A886.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C22.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F69B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E7E5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39ED.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C2D4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	924.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1EDF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3351.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3535.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37BB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FE4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6DAB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1D8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCCC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCD9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21F1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3653.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61C8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D459.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	299D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A7A0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC3B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	279E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2859.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1317.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23B1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2C6B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5139.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F9A.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1300	936	2026-07-24_5c0f14c415f600887ee729f63218c57f_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 1300 wrote to memory of 2620	1300	649C.tmp	90
PID 2620 wrote to memory of 5148	2620	6596.tmp	91
PID 5148 wrote to memory of 2500	5148	6AE5.tmp	92
PID 2500 wrote to memory of 5916	2500	6ECD.tmp	93
PID 5916 wrote to memory of 2552	5916	7267.tmp	94
PID 2552 wrote to memory of 3088	2552	75E2.tmp	95
PID 3088 wrote to memory of 2592	3088	7872.tmp	96
PID 2592 wrote to memory of 3484	2592	7B70.tmp	97
PID 3484 wrote to memory of 5968	3484	7E4E.tmp	98
PID 5968 wrote to memory of 2844	5968	811D.tmp	99
PID 2844 wrote to memory of 3128	2844	83EC.tmp	100
PID 3128 wrote to memory of 3600	3128	86E9.tmp	101
PID 3600 wrote to memory of 5924	3600	88CE.tmp	102
PID 5924 wrote to memory of 3056	5924	8B7D.tmp	103
PID 3056 wrote to memory of 5264	3056	8E1D.tmp	104
PID 5264 wrote to memory of 5588	5264	90FB.tmp	105
PID 5588 wrote to memory of 1732	5588	94B4.tmp	106
PID 1732 wrote to memory of 5808	1732	9793.tmp	107
PID 5808 wrote to memory of 5632	5808	9A62.tmp	108
PID 5632 wrote to memory of 960	5632	9D11.tmp	109
PID 960 wrote to memory of 2916	960	9FC1.tmp	110
PID 2916 wrote to memory of 2852	2916	A241.tmp	111
PID 2852 wrote to memory of 1676	2852	A520.tmp	112
PID 1676 wrote to memory of 2904	1676	A7A0.tmp	113
PID 2904 wrote to memory of 3900	2904	A8F8.tmp	114
PID 3900 wrote to memory of 1276	3900	AC63.tmp	115
PID 1276 wrote to memory of 1108	1276	AE18.tmp	116
PID 1108 wrote to memory of 2376	1108	B01C.tmp	117
PID 2376 wrote to memory of 5864	2376	B210.tmp	118
PID 5864 wrote to memory of 3464	5864	B51D.tmp	119
PID 3464 wrote to memory of 3804	3464	B675.tmp	120
PID 3804 wrote to memory of 2432	3804	B7CD.tmp	121
PID 2432 wrote to memory of 1116	2432	BCAF.tmp	122
PID 1116 wrote to memory of 5820	1116	BD99.tmp	123
PID 5820 wrote to memory of 5780	5820	BEA3.tmp	124
PID 5780 wrote to memory of 5080	5780	BFCC.tmp	125
PID 5080 wrote to memory of 2480	5080	C0E5.tmp	126
PID 2480 wrote to memory of 6012	2480	C21D.tmp	127
PID 6012 wrote to memory of 5860	6012	C346.tmp	128
PID 5860 wrote to memory of 4400	5860	C450.tmp	129
PID 4400 wrote to memory of 4444	4400	C569.tmp	130
PID 4444 wrote to memory of 4472	4444	C663.tmp	131
PID 4472 wrote to memory of 5980	4472	C71F.tmp	132
PID 5980 wrote to memory of 4676	5980	C7BB.tmp	133
PID 4676 wrote to memory of 3284	4676	C857.tmp	134
PID 3284 wrote to memory of 1772	3284	C922.tmp	135
PID 1772 wrote to memory of 4712	1772	CA4B.tmp	136
PID 4712 wrote to memory of 4688	4712	CB64.tmp	137
PID 4688 wrote to memory of 4408	4688	CC20.tmp	138
PID 4408 wrote to memory of 4212	4408	CCCC.tmp	139
PID 4212 wrote to memory of 5320	4212	CD97.tmp	140
PID 5320 wrote to memory of 3124	5320	CE33.tmp	141
PID 3124 wrote to memory of 1412	3124	CEDF.tmp	142
PID 1412 wrote to memory of 4388	1412	CF7B.tmp	143
PID 4388 wrote to memory of 3212	4388	D056.tmp	144
PID 3212 wrote to memory of 992	3212	D131.tmp	145
PID 992 wrote to memory of 5260	992	D1EC.tmp	146
PID 5260 wrote to memory of 4856	5260	D298.tmp	147
PID 4856 wrote to memory of 4892	4856	D373.tmp	148
PID 4892 wrote to memory of 1072	4892	D46D.tmp	149
PID 1072 wrote to memory of 3240	1072	D5A5.tmp	150
PID 3240 wrote to memory of 3184	3240	D651.tmp	151
PID 3184 wrote to memory of 4776	3184	D6FD.tmp	153

C:\Users\Admin\AppData\Local\Temp\2026-07-24_5c0f14c415f600887ee729f63218c57f_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_5c0f14c415f600887ee729f63218c57f_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\649C.tmp
  "C:\Users\Admin\AppData\Local\Temp\649C.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\6596.tmp
    "C:\Users\Admin\AppData\Local\Temp\6596.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\6AE5.tmp
      "C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\6ECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\7267.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7267.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\75E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75E2.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\7872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7872.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\7B70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B70.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\7E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\811D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\811D.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\83EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83EC.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\86E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86E9.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\88CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88CE.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\8B7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\8E1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\90FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90FB.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\94B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B4.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\9793.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9793.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\9A62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A62.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\9D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D11.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\9FC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\A241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A241.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\A520.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A520.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\A7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\A8F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\AC63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC63.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\AE18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE18.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\B01C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B01C.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\B210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B210.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\B51D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B51D.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\B675.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B675.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\B7CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\BCAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\BD99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD99.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\BEA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\BFCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\C0E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\C21D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C21D.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\C346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C346.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\C450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C450.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\C569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C569.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\C663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C663.tmp"
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\C71F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C71F.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\C7BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\C857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C857.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\C922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C922.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\CA4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\CB64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB64.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\CC20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC20.tmp"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\CCCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\CD97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD97.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\CE33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE33.tmp"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\CEDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\CF7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\D056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D056.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\D131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D131.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\D1EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\D298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D298.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\D373.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D373.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\D46D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D46D.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\D5A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\D651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D651.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\D6FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\D7E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"
        65⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\D8A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"
        66⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\D98D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D98D.tmp"
        67⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\DA59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA59.tmp"
        68⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\DB24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB24.tmp"
        69⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\DC0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"
        70⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\DCD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\DD95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD95.tmp"
        72⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\DE50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE50.tmp"
        73⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\DEFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"
        74⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\DFA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"
        75⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\E054.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E054.tmp"
        76⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\E10F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E10F.tmp"
        77⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\E1BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"
        78⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\E277.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E277.tmp"
        79⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\E313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E313.tmp"
        80⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\E3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"
        81⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\E47A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E47A.tmp"
        82⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\E517.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E517.tmp"
        83⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\E5C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"
        84⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\E67E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E67E.tmp"
        85⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\E72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E72A.tmp"
        86⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\E7E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\E891.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E891.tmp"
        88⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\E94D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E94D.tmp"
        89⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\EA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA18.tmp"
        90⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\EAC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"
        91⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\EB70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB70.tmp"
        92⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\EC3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\ECE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"
        94⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\EDA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"
        95⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\EE5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"
        96⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\EF19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF19.tmp"
        97⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\EFC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"
        98⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\F080.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F080.tmp"
        99⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\F11D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F11D.tmp"
        100⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\F1D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\F294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F294.tmp"
        102⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\F330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F330.tmp"
        103⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\F3CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"
        104⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\F478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F478.tmp"
        105⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\F524.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F524.tmp"
        106⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\F5DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"
        107⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\F69B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F69B.tmp"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\F728.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F728.tmp"
        109⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\F802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F802.tmp"
        110⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\F89F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F89F.tmp"
        111⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\F95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F95A.tmp"
        112⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\FA06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA06.tmp"
        113⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\FAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"
        114⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\FB4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"
        115⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\FBFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"
        116⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\FCB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"
        117⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\FD61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD61.tmp"
        118⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\FE1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"
        119⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\FEC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"
        120⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\FF94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF94.tmp"
        121⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F.tmp"
        122⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB.tmp"
        123⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\1C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C6.tmp"
        124⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\282.tmp"
        125⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\33D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33D.tmp"
        126⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\3F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F9.tmp"
        127⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4.tmp"
        128⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58F.tmp"
        129⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\62B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62B.tmp"
        130⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\6E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E7.tmp"
        131⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\7A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A2.tmp"
        132⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\85E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85E.tmp"
        133⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\919.tmp"
        134⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\9E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E4.tmp"
        135⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A90.tmp"
        136⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\B5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5B.tmp"
        137⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\BF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF8.tmp"
        138⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB3.tmp"
        139⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F.tmp"
        140⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1B.tmp"
        141⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15.tmp"
        142⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB1.tmp"
        143⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\106C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\106C.tmp"
        144⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\1118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1118.tmp"
        145⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\11D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11D4.tmp"
        146⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\128F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\128F.tmp"
        147⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\133B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\133B.tmp"
        148⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\1416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1416.tmp"
        149⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\14D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D1.tmp"
        150⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\159C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\159C.tmp"
        151⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\1639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1639.tmp"
        152⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\16F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16F4.tmp"
        153⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\17B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B0.tmp"
        154⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\186B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\186B.tmp"
        155⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\1927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1927.tmp"
        156⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\1A01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A01.tmp"
        157⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\1AAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"
        158⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\1B78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B78.tmp"
        159⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\1C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C34.tmp"
        160⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\1CEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"
        161⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\1D8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"
        162⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\1E28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E28.tmp"
        163⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\1F03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F03.tmp"
        164⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\1FBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\206A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\206A.tmp"
        166⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\2145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2145.tmp"
        167⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\21F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21F1.tmp"
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\22AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22AC.tmp"
        169⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\2368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2368.tmp"
        170⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\2452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2452.tmp"
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\250E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\250E.tmp"
        172⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\25F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F8.tmp"
        173⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\26B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26B3.tmp"
        174⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\279E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279E.tmp"
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\2859.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2859.tmp"
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\2934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2934.tmp"
        177⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\2A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"
        178⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\2AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"
        179⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\2B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B95.tmp"
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\2C61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C61.tmp"
        181⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\2D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"
        182⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\2DC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"
        183⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\2E74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E74.tmp"
        184⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\2F4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"
        185⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\301A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\301A.tmp"
        186⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\30C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30C6.tmp"
        187⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\31A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31A0.tmp"
        188⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\325C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\325C.tmp"
        189⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\3327.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3327.tmp"
        190⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\33F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33F2.tmp"
        191⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\34AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34AE.tmp"
        192⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\3569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3569.tmp"
        193⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\3653.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3653.tmp"
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\36F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36F0.tmp"
        195⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\37BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37BB.tmp"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\3876.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3876.tmp"
        197⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\3941.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3941.tmp"
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\39ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39ED.tmp"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\3AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AA9.tmp"
        200⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\3B64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B64.tmp"
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\3C20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C20.tmp"
        202⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\3CEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"
        203⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\3D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D97.tmp"
        204⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\3E43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E43.tmp"
        205⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\3EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"
        206⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\3F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F9A.tmp"
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\4066.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4066.tmp"
        208⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\4111.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4111.tmp"
        209⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\41EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41EC.tmp"
        210⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\4298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4298.tmp"
        211⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\4354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4354.tmp"
        212⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\440F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440F.tmp"
        213⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\44DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44DA.tmp"
        214⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\4596.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4596.tmp"
        215⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\4642.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4642.tmp"
        216⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\470D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\470D.tmp"
        217⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\47F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F7.tmp"
        218⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\48D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48D2.tmp"
        219⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\499D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\499D.tmp"
        220⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\4A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A58.tmp"
        221⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\4B24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B24.tmp"
        222⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\4BCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"
        223⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\4C6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"
        224⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\4D08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D08.tmp"
        225⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\4DD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\4E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E6F.tmp"
        227⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\4F2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"
        228⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\4FC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"
        229⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\50A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50A2.tmp"
        230⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\515D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\515D.tmp"
        231⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\5219.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5219.tmp"
        232⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\5303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5303.tmp"
        233⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\53CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53CE.tmp"
        234⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\548A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\548A.tmp"
        235⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\5545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5545.tmp"
        236⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\55F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55F1.tmp"
        237⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\56CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56CC.tmp"
        238⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\5778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5778.tmp"
        239⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\5824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5824.tmp"
        240⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\58D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58D0.tmp"
        241⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\597B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\597B.tmp"
        242⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\5A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A66.tmp"
        243⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\5B41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B41.tmp"
        244⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\5BEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"
        245⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\5C98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C98.tmp"
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\5D54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D54.tmp"
        247⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\5E2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\5EEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"
        249⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\5FA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FA6.tmp"
        250⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\6071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6071.tmp"
        251⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\611D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\611D.tmp"
        252⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\61C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61C8.tmp"
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\62A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62A3.tmp"
        254⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\634F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\634F.tmp"
        255⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\641A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\641A.tmp"
        256⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\64D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64D6.tmp"
        257⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\65A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65A1.tmp"
        258⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\665C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\665C.tmp"
        259⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\66F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66F9.tmp"
        260⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\67B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67B4.tmp"
        261⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\687F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\687F.tmp"
        262⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\692B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\692B.tmp"
        263⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\69F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69F6.tmp"
        264⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\6AA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"
        265⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\6B5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B5E.tmp"
        266⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\6C09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C09.tmp"
        267⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\6CE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CE4.tmp"
        268⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\6DAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DAF.tmp"
        269⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\6E5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"
        270⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\6F36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F36.tmp"
        271⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\6FE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"
        272⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\709D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\709D.tmp"
        273⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\7168.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7168.tmp"
        274⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\7224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7224.tmp"
        275⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\72D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72D0.tmp"
        276⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\737C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\737C.tmp"
        277⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\7437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7437.tmp"
        278⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\7512.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7512.tmp"
        279⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\75BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75BE.tmp"
        280⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\7679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7679.tmp"
        281⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\7754.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7754.tmp"
        282⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\7800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7800.tmp"
        283⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\78BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78BB.tmp"
        284⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\7977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7977.tmp"
        285⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\7A32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A32.tmp"
        286⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\7AEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AEE.tmp"
        287⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\7BB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"
        288⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\803D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\803D.tmp"
        289⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\80F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80F9.tmp"
        290⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\81C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81C4.tmp"
        291⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\829F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\829F.tmp"
        292⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\835A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\835A.tmp"
        293⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\8416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8416.tmp"
        294⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\84E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84E1.tmp"
        295⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\85BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85BC.tmp"
        296⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\8658.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8658.tmp"
        297⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\8704.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8704.tmp"
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\87BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87BF.tmp"
        299⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\888A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\888A.tmp"
        300⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\8936.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8936.tmp"
        301⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\89D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89D2.tmp"
        302⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\8AAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AAD.tmp"
        303⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\8B59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B59.tmp"
        304⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\8BF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BF5.tmp"
        305⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\8CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"
        306⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\8DBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\8E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E95.tmp"
        308⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\8F31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F31.tmp"
        309⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\901C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\901C.tmp"
        310⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\90B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90B8.tmp"
        311⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\9183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9183.tmp"
        312⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\923F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\923F.tmp"
        313⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\930A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\930A.tmp"
        314⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\93B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93B6.tmp"
        315⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\9490.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9490.tmp"
        316⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\954C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\954C.tmp"
        317⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\9607.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9607.tmp"
        318⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\96D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96D3.tmp"
        319⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\97AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97AD.tmp"
        320⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\9869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9869.tmp"
        321⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\9924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9924.tmp"
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\99E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E0.tmp"
        323⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\9A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A9B.tmp"
        324⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\9B66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B66.tmp"
        325⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\9C12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C12.tmp"
        326⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\9CED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CED.tmp"
        327⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\9DA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"
        328⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\9E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E64.tmp"
        329⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\9F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F10.tmp"
        330⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\9FEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"
        331⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\A0B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0B6.tmp"
        332⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\A152.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A152.tmp"
        333⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\A1FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"
        334⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\A2D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2D9.tmp"
        335⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\A394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A394.tmp"
        336⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\A450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A450.tmp"
        337⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\A4FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4FC.tmp"
        338⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\A5B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5B7.tmp"
        339⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\A663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A663.tmp"
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\A70F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A70F.tmp"
        341⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\A7CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7CA.tmp"
        342⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\A886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A886.tmp"
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\A961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A961.tmp"
        344⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\AA2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA2C.tmp"
        345⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\AAE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"
        346⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\AB93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB93.tmp"
        347⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\AC4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"
        348⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\ACFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFA.tmp"
        349⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\ADC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADC6.tmp"
        350⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\AEA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"
        351⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\AF3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF3D.tmp"
        352⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\B008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B008.tmp"
        353⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\B0C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0C3.tmp"
        354⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\B18E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B18E.tmp"
        355⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\B21B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B21B.tmp"
        356⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\B2C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"
        357⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\B392.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B392.tmp"
        358⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\B45D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B45D.tmp"
        359⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\B519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B519.tmp"
        360⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\B5D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5D4.tmp"
        361⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\B690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B690.tmp"
        362⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\B75B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B75B.tmp"
        363⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\B816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B816.tmp"
        364⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\B8F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8F1.tmp"
        365⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\B9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9BC.tmp"
        366⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\BA68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA68.tmp"
        367⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\BB33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB33.tmp"
        368⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\BBEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"
        369⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\BCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAA.tmp"
        370⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\BD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD56.tmp"
        371⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\BE40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE40.tmp"
        372⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\BEDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEDD.tmp"
        373⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\BF98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF98.tmp"
        374⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\C063.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C063.tmp"
        375⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\C13E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C13E.tmp"
        376⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\C209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C209.tmp"
        377⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\C2D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D4.tmp"
        378⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\C380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C380.tmp"
        379⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\C43C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C43C.tmp"
        380⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\C507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C507.tmp"
        381⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\C5B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5B3.tmp"
        382⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\C67E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C67E.tmp"
        383⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\C739.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C739.tmp"
        384⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\C7F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7F5.tmp"
        385⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\C8C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8C0.tmp"
        386⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\C96C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C96C.tmp"
        387⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\CA46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA46.tmp"
        388⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\CAF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAF2.tmp"
        389⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\CBEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBEC.tmp"
        390⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\CC89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC89.tmp"
        391⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\CD54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD54.tmp"
        392⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\CE0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE0F.tmp"
        393⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\CECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CECB.tmp"
        394⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\CFC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFC5.tmp"
        395⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\D061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D061.tmp"
        396⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\D14B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D14B.tmp"
        397⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\D226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D226.tmp"
        398⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\D301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D301.tmp"
        399⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\D39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D39D.tmp"
        400⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\D459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D459.tmp"
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\D572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D572.tmp"
        402⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\D63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D63D.tmp"
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\D6F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F8.tmp"
        404⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\D7B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7B4.tmp"
        405⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\D86F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D86F.tmp"
        406⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\D92B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D92B.tmp"
        407⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\D9F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9F6.tmp"
        408⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\DAC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAC1.tmp"
        409⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\DBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBAC.tmp"
        410⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\DC57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC57.tmp"
        411⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\DD13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD13.tmp"
        412⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\DDDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDDE.tmp"
        413⤵
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\DEA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEA9.tmp"
        414⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\DF65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF65.tmp"
        415⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\E011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E011.tmp"
        416⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\E0AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0AD.tmp"
        417⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\E168.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E168.tmp"
        418⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\E1F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1F5.tmp"
        419⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\E2DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2DF.tmp"
        420⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\E3BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"
        421⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\E495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E495.tmp"
        422⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\E58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E58F.tmp"
        423⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\E64A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64A.tmp"
        424⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\E706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E706.tmp"
        425⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\E7E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7E1.tmp"
        426⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\E8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8AC.tmp"
        427⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\E958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E958.tmp"
        428⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\EA32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA32.tmp"
        429⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\EB2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB2C.tmp"
        430⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\EC07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC07.tmp"
        431⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\ECC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECC3.tmp"
        432⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\ED8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED8E.tmp"
        433⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\EE78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE78.tmp"
        434⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\EF24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF24.tmp"
        435⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\EFDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFDF.tmp"
        436⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\F0AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0AB.tmp"
        437⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\F166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F166.tmp"
        438⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\F222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F222.tmp"
        439⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\F2FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2FC.tmp"
        440⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\F3C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3C7.tmp"
        441⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\F4C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4C1.tmp"
        442⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\F59C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F59C.tmp"
        443⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\F648.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F648.tmp"
        444⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\F713.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F713.tmp"
        445⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\F7EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7EE.tmp"
        446⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\F8A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8A9.tmp"
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\F975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F975.tmp"
        448⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\FA40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA40.tmp"
        449⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\FB2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB2A.tmp"
        450⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\FBF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBF5.tmp"
        451⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\FCD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD0.tmp"
        452⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\FD9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD9B.tmp"
        453⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\FE66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE66.tmp"
        454⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\FF31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF31.tmp"
        455⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\FFFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFFC.tmp"
        456⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8.tmp"
        457⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\173.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\173.tmp"
        458⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\23F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F.tmp"
        459⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\2EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EA.tmp"
        460⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\3B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B6.tmp"
        461⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\471.tmp"
        462⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\54C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54C.tmp"
        463⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617.tmp"
        464⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\6E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E2.tmp"
        465⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\7AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AD.tmp"
        466⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\869.tmp"
        467⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\924.tmp"
        468⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\9FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FF.tmp"
        469⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\AAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAB.tmp"
        470⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\B66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B66.tmp"
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C22.tmp"
        472⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFD.tmp"
        473⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\DD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD7.tmp"
        474⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\E74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E74.tmp"
        475⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\F3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3F.tmp"
        476⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\1019.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1019.tmp"
        477⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\10E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10E5.tmp"
        478⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\11B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11B0.tmp"
        479⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\125C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\125C.tmp"
        480⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\1317.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1317.tmp"
        481⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\13D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13D3.tmp"
        482⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\149E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\149E.tmp"
        483⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\1569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1569.tmp"
        484⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\1663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1663.tmp"
        485⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\171E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\171E.tmp"
        486⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\1809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1809.tmp"
        487⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\18D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18D4.tmp"
        488⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\19BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19BE.tmp"
        489⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\1AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AA9.tmp"
        490⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\1B74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B74.tmp"
        491⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\1C5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C5E.tmp"
        492⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\1D29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D29.tmp"
        493⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\1E04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E04.tmp"
        494⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\1EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EDF.tmp"
        495⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\1FB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FB9.tmp"
        496⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\20B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20B3.tmp"
        497⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\217F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\217F.tmp"
        498⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\223A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\223A.tmp"
        499⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\22E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22E6.tmp"
        500⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\23B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23B1.tmp"
        501⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\249B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\249B.tmp"
        502⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\2576.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2576.tmp"
        503⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\2622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2622.tmp"
        504⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\271C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\271C.tmp"
        505⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\27E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27E7.tmp"
        506⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\28C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28C2.tmp"
        507⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\299D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\299D.tmp"
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\2A87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A87.tmp"
        509⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\2BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA0.tmp"
        510⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\2C6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C6B.tmp"
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\2D56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D56.tmp"
        512⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\2E40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E40.tmp"
        513⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\2F0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F0B.tmp"
        514⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\2FD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FD6.tmp"
        515⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\30B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30B1.tmp"
        516⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\318C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\318C.tmp"
        517⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\3296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3296.tmp"
        518⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\3351.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3351.tmp"
        519⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\344B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\344B.tmp"
        520⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\3535.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3535.tmp"
        521⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\3620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3620.tmp"
        522⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\36BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36BC.tmp"
        523⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\3787.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3787.tmp"
        524⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\3881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3881.tmp"
        525⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\397B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\397B.tmp"
        526⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\3A56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A56.tmp"
        527⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\3B11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B11.tmp"
        528⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\3BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BDD.tmp"
        529⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\3CB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CB7.tmp"
        530⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\3D73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D73.tmp"
        531⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\3E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E4E.tmp"
        532⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\3F19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F19.tmp"
        533⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\3FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FE4.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\40AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40AF.tmp"
        535⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\41A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41A9.tmp"
        536⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\4264.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4264.tmp"
        537⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\4330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4330.tmp"
        538⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\440A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440A.tmp"
        539⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\44D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44D5.tmp"
        540⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\45A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45A1.tmp"
        541⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\468B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\468B.tmp"
        542⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\4727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4727.tmp"
        543⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\47F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F2.tmp"
        544⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\48BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48BD.tmp"
        545⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\4969.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4969.tmp"
        546⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\4A25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A25.tmp"
        547⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\4AB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AB1.tmp"
        548⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\4B6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B6D.tmp"
        549⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\4C57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C57.tmp"
        550⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\4D32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D32.tmp"
        551⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\4DFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DFD.tmp"
        552⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\4ED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ED8.tmp"
        553⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\4F93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F93.tmp"
        554⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\506E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\506E.tmp"
        555⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\5139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5139.tmp"
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\5224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5224.tmp"
        557⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\52DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52DF.tmp"
        558⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\53BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53BA.tmp"
        559⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\5495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5495.tmp"
        560⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\5550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5550.tmp"
        561⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\560C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\560C.tmp"
        562⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\56E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56E6.tmp"
        563⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\584E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\584E.tmp"
        564⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\5909.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5909.tmp"
        565⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\5A03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A03.tmp"
        566⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\5ACE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ACE.tmp"
        567⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\5B9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B9A.tmp"
        568⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\5C74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C74.tmp"
        569⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\5D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D30.tmp"
        570⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\5E0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E0B.tmp"
        571⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\5EB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EB6.tmp"
        572⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\5F91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F91.tmp"
        573⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\604D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\604D.tmp"
        574⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\6118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6118.tmp"
        575⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\61D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61D3.tmp"
        576⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\62AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62AE.tmp"
        577⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\636A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\636A.tmp"
        578⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\6444.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6444.tmp"
        579⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\6500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6500.tmp"
        580⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\65CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65CB.tmp"
        581⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\6696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6696.tmp"
        582⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\6752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6752.tmp"
        583⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\681D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\681D.tmp"
        584⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\68D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68D8.tmp"
        585⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\69C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69C3.tmp"
        586⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\6A6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A6E.tmp"
        587⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\6B49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B49.tmp"
        588⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\6C14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C14.tmp"
        589⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\6D0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D0E.tmp"
        590⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\6DAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DAB.tmp"
        591⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\6EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EA5.tmp"
        592⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\6F50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F50.tmp"
        593⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\701C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\701C.tmp"
        594⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\7116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7116.tmp"
        595⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\71D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71D1.tmp"
        596⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\729C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\729C.tmp"
        597⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\7377.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7377.tmp"
        598⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\7432.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7432.tmp"
        599⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\74EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74EE.tmp"
        600⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\75C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75C9.tmp"
        601⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\76A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76A3.tmp"
        602⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\774F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\774F.tmp"
        603⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\77EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77EC.tmp"
        604⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\78C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78C6.tmp"
        605⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\7991.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7991.tmp"
        606⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\7A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A5D.tmp"
        607⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\7B28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B28.tmp"
        608⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\7C12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C12.tmp"
        609⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\7CDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"
        610⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\7DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"
        611⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\7EA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"
        612⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\7F6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"
        613⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\8019.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8019.tmp"
        614⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\80D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80D5.tmp"
        615⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\8190.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8190.tmp"
        616⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\823C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\823C.tmp"
        617⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\8317.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8317.tmp"
        618⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\83E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83E2.tmp"
        619⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\849E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\849E.tmp"
        620⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\8559.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8559.tmp"
        621⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\8624.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8624.tmp"
        622⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\86E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86E0.tmp"
        623⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\879B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\879B.tmp"
        624⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\8857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8857.tmp"
        625⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\8922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8922.tmp"
        626⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\89CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89CE.tmp"
        627⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\8AA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AA8.tmp"
        628⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\8B74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B74.tmp"
        629⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\8C1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C1F.tmp"
        630⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\8CDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CDB.tmp"
        631⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\8DA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DA6.tmp"
        632⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\8E52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E52.tmp"
        633⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\8F4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F4C.tmp"
        634⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\9027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9027.tmp"
        635⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\90D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90D3.tmp"
        636⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\91AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91AD.tmp"
        637⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\9278.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9278.tmp"
        638⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\9324.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9324.tmp"
        639⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\93D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93D0.tmp"
        640⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\94BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94BB.tmp"
        641⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\9566.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9566.tmp"
        642⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\9622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9622.tmp"
        643⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\96ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96ED.tmp"
        644⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\97A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97A9.tmp"
        645⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\9864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9864.tmp"
        646⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\9910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9910.tmp"
        647⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\99BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99BC.tmp"
        648⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\9A68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A68.tmp"
        649⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\9B14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B14.tmp"
        650⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\9BB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BB0.tmp"
        651⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\9C6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C6B.tmp"
        652⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\9D17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D17.tmp"
        653⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\9DD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DD3.tmp"
        654⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\9EBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EBD.tmp"
        655⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\9F69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F69.tmp"
        656⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\A024.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A024.tmp"
        657⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\A0D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0D0.tmp"
        658⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\A19B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A19B.tmp"
        659⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\A276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A276.tmp"
        660⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\A332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A332.tmp"
        661⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\A3DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3DE.tmp"
        662⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\A499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A499.tmp"
        663⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\A564.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A564.tmp"
        664⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\A620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A620.tmp"
        665⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\A6DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6DB.tmp"
        666⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\A797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A797.tmp"
        667⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\A852.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A852.tmp"
        668⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\A90E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A90E.tmp"
        669⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\A9BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9BA.tmp"
        670⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\AA85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA85.tmp"
        671⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\AB31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB31.tmp"
        672⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\ABEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABEC.tmp"
        673⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\ACB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACB7.tmp"
        674⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\AD73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD73.tmp"
        675⤵
        
        PID:6584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

649C.tmp

Path C:\Users\Admin\AppData\Local\Temp\649C.tmp
Size 3.6MB
SHA256 2a076d94a723e014c1f1af5c88355585797af8b5ad1a5f9c691b3ee6c00477c7
MD5 b622d9aa41964eb3a6275f9717c99e8d
SHA1 e0f4adc51ca9793a94b0200d0343bc48d5e84f7a
SHA512 c058a7a6b5578905a0394d5fa80454bfe473df168014735b2585435e6554f2b214c5b36a961e20472fba47f222a9a7cb001701abe5fe370e707f616783084f4f
SSDEEP 49152:w/OJDMgeXCF0NGEADt7i+/yTukuFGNLrkBirx:EOnlF0chrSiGdkBirx
TLSH
T13A06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6596.tmp

Path C:\Users\Admin\AppData\Local\Temp\6596.tmp
Size 3.6MB
SHA256 27a766778765408bbcd157f4e3ea67318211bf6000fdfb59d9a09631b08a1fab
MD5 f226b0eaf38560bb333257e2f4dc31c1
SHA1 57ee794c2e69b6dd725a4bb4444d4be531a4457e
SHA512 36121380c3c9dfafbab700be854e90c1e394f936405c7bf23ea64dc75d2c9f4a44431fcd5dbfc7dac549aafa15ca42a652bd78a89b2536c289663f2794f7133c
SSDEEP 49152:w/OJDU+hSEHCNGEADt7i+/yTukuFGNLrkBirx:EOioCchrSiGdkBirx
TLSH
T1630693113BFAC635F2BF8B316EB2E654197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6AE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\6AE5.tmp
Size 3.6MB
SHA256 e3bb5c55b935e8536a82823922bc1ec7babb0f14f3594d488b5671d4a274a103
MD5 00a97045a53c6af18048680499289be4
SHA1 62ab4752cfad3c4e28676152878a75c355e3b3be
SHA512 69c4d27ecf25b830c2d235a9e94117f6b3c9e68de0593b8cd1bc5cb2c4eae9bd72dffd242de94e6ddeef922e15dccaf4402bf2a0fb7812bfe62bb034c6760a68
SSDEEP 49152:w/OJDZxMLIQ+CNGEADt7i+/yTukuFGNLrkBirx:EO7xaTZchrSiGdkBirx
TLSH
T17006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ECD.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ECD.tmp
Size 3.6MB
SHA256 5953f6b76e94ace5f73d8fdbf2fd56539e5e2f5ffd59dd90376ecb405f21832e
MD5 b99363fc64d5ea9e37aef97cc3c9499c
SHA1 97dc54b754aa481379a1c1b237a9cd5681b86b19
SHA512 bde6a0a8a3b4760c5e731f185cccf636b27094822d7f43bc873493da614755d18636e7311ffab9ab55c616ea6a25c178073871204a61e70c72d778da28833746
SSDEEP 24576:wUQOJDXr4NGEAFC5etW0Ri+aMyFH1K/PkuRe8GNLJhkBir2ZPevL:w/OJD0NGEADt7i+/yTukuFGNLrkBirx
TLSH
T1AB06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7267.tmp

Path C:\Users\Admin\AppData\Local\Temp\7267.tmp
Size 3.6MB
SHA256 47f2ecd0ac1a80338571ebd1560f4c8161a279dfe067dff5c2d4e00f837671a2
MD5 cc2ea738eb5af98eec45c75dbfaabd93
SHA1 d1390d10fea260329cd751b34cbe34bce2afede8
SHA512 5f4e9377650b3d1c5de589b36630f0e98d2245a823a1c357e4d4590bdfa4708e3ff6ff5c2023d41cf62524b50070415a5437b484939efa85ef516c9390246b91
SSDEEP 49152:w/OJDb8mTMLPNGEADt7i+/yTukuFGNLrkBirx:EOAPchrSiGdkBirx
TLSH
T10606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\75E2.tmp
Size 3.6MB
SHA256 bde55e0d9fc9b710e81a974ca763b58047b89f5ab6f5e84146c11518757e7e5f
MD5 cfe7e483e2d3022e5069e0085d816417
SHA1 06bae17b6479164d92c752dfd239b107dbd3f953
SHA512 1d3fb7e7446564c57f19340b493bb791c7f0f695fcebe59d8f9f41411747e0ba8b661937a65f384556ee954b119876fa912ebd3e113c0476d0f96536187944a0
SSDEEP 49152:w/OJDCVrNGEADt7i+/yTukuFGNLrkBirx:EOIVrchrSiGdkBirx
TLSH
T16E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7872.tmp

Path C:\Users\Admin\AppData\Local\Temp\7872.tmp
Size 3.6MB
SHA256 a98f73a6b7cfb371602bd980727b8b953942ef26d207b113c268e11695f2d3d1
MD5 a884990564ec312dbd2cce4d6a83cc29
SHA1 8ebf3db08fd9dbf3eb111d2676180979067a26f1
SHA512 5ffae5c32e7b70f1b82a835930db33cd94ef1d8d73275f861b3c13e25b39510e291f02f17a710fe47124f3c5b3befe4c03bc416aaaee6ec535be4d3b0e2562c7
SSDEEP 49152:w/OJD+pNlk5xnYNGEADt7i+/yTukuFGNLrkBirx:EO+EschrSiGdkBirx
TLSH
T11406931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B70.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B70.tmp
Size 3.6MB
SHA256 f7efa14fa2f3394c0c4a6b4cb7786b8f49f479c0a2fbf8dc2ce48d238a54e31f
MD5 e1593abb2f1bc5f2b73dd35ff6983adb
SHA1 c283b405464bf5a34866be84dea08ac92b702c5a
SHA512 59e0023c954bafbfc415e5053b3d49185b8bb124d5b4f9707c4e955c83d53d2ff8da29d32a8f3e9c68387b101d1ecabe223bca88a800411b8a146fb31686fa36
SSDEEP 49152:w/OJDPUAWrbFhENGEADt7i+/yTukuFGNLrkBirx:EOi5rbFhEchrSiGdkBirx
TLSH
T11F06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E4E.tmp
Size 3.6MB
SHA256 1a53e66ad48f7ecbe6348bdd43bde654541b43df6d1b4cab2b8174c07b98ef32
MD5 c271f4b25ffcb85dc43aa63c410b3621
SHA1 3264794cd9ecf993637a5b15a6f99f07a9e601e7
SHA512 cffecdc93d6a3b0505f56eb8dc02c5c8b094d3440e7b4907fabc7f099dba333319adbc7ee0f366cd1324820637ba900cddd32036466ee0c2c98381f5872f2efe
SSDEEP 49152:w/OJD+Qq6i0DNGEADt7i+/yTukuFGNLrkBirx:EOEvOchrSiGdkBirx
TLSH
T13106931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

811D.tmp

Path C:\Users\Admin\AppData\Local\Temp\811D.tmp
Size 3.6MB
SHA256 7a2c5f80eaac66fe3a89652a061dddd8de96abafa572108a08c76bf4daca46ad
MD5 71fe4fe9e5c8dc1b55e736d07add0d3c
SHA1 527ed45a2099c39a5d91a65c71e0e33140467dd5
SHA512 dcc041dd544b250ed02fde9b8b6ab71616686ca8dccc045a7f813f76e77109f442cc9c975fc5d8e8f44dd49cb550633ad6fe5b96d957e7ea882a27f49a090ac6
SSDEEP 49152:w/OJDOTzNGEADt7i+/yTukuFGNLrkBirx:EO+chrSiGdkBirx
TLSH
T1A306931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\83EC.tmp
Size 3.6MB
SHA256 551b3a1bb4a6b44193d7d7d3ed06d53053d951ac89850a0914fde7eb85f0223a
MD5 7916dd1d2be8e53db956a99e8b23025b
SHA1 cbddf99eae2532fd233cb2fe417ce80502caa23d
SHA512 9e405b7d42636f336a36bfde61b4c4abcb6fc93fb1014dd3cc8b24a50d6110e7904ca99ef7154648d7400bcaad346ce4599e02aaa62b5cafec65eaf381d5331a
SSDEEP 49152:w/OJDJtx1NPxgNGEADt7i+/yTukuFGNLrkBirx:EO3r1IchrSiGdkBirx
TLSH
T1D806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\86E9.tmp
Size 3.6MB
SHA256 a735d867493e85311f294444746bf93e225693f876f90c3693fba3fe9a91896c
MD5 bb2becdc76728292f78bdcc3a9f6f416
SHA1 2533065d809f20b94a7c0ad50395c3c0994a864e
SHA512 7056c77889e58a45ab16bd2482878ec7bd77020826bcf0eab2da22e154abbd0397429f915ce0526a69e6d222373a4907bf43433cdd66820a39fffd70f1d3c366
SSDEEP 49152:w/OJD90GvOANGEADt7i+/yTukuFGNLrkBirx:EOf03AchrSiGdkBirx
TLSH
T19F06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\88CE.tmp
Size 3.6MB
SHA256 c4cb22e5e49fa389af69870b0e4f578fcb3fc3298b9a43de18e62d969d0a48e6
MD5 5aa405677db71d10f28f5b2b63ab56d6
SHA1 fae1d76a66ce0c3ed8583688b1da95c11a90a356
SHA512 e1a5553af2f5151498dbbc6b80557eeb4f3770e80cb90f8807d02f1e59ea5fd22395d5fdc45291b4f5c4c16d509d0d8c8c4034fbeda77d1681eef379eacf0585
SSDEEP 49152:w/OJD0ESNGEADt7i+/yTukuFGNLrkBirx:EOqchrSiGdkBirx
TLSH
T1CE06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B7D.tmp
Size 3.6MB
SHA256 6f366a2c5b95585b3da37fd79b9e5d4c8e10a4fca53761d03f4c809d03c1b57f
MD5 7dfb3801e2acbfcd1c7de4924b42eff2
SHA1 350faef5f2526995b50e72545b848eb307c7e304
SHA512 22c767cf3c810d1449e62a16cb231b580b8a5c6978c78a883aad95e4fa8faa6a6d2cd07af7dfd111dd1cdc6d6f5a06e8fcd51b8ba6f996c517f164d3bfa8835c
SSDEEP 49152:w/OJDpCPcfzNGEADt7i+/yTukuFGNLrkBirx:EO7C0fzchrSiGdkBirx
TLSH
T13E06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8E1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8E1D.tmp
Size 3.6MB
SHA256 4eb81c2dad9c1f4139ca6ef4a1260f054113c94aa43a154006ec778b69b822ad
MD5 1e98059b3e8af26757e5a4fdd488723c
SHA1 6b085b6d871cbd1857f1eea32110c5e276126a1d
SHA512 73152282025207cf163dbbc9b1c4714b5e437e1a06ee1e7d82c8ee258d68522fd340c839277e2d19ff2dcb57536d9db1c9b719279d62e81d8f5927c1c0230e04
SSDEEP 49152:w/OJDpBcQBzNGEADt7i+/yTukuFGNLrkBirx:EOjBcQ5chrSiGdkBirx
TLSH
T19806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\90FB.tmp
Size 3.6MB
SHA256 a63cc1ab5bc1c5a7e661fc4f2e66673ae6460718f0e87834f8a47332ff187311
MD5 80c084e33bd61b52a37f67532c6f93c0
SHA1 dd1b814f03093cf801fa69615126138418a065ff
SHA512 9fed56938b719a84b6f31c4af8543b6ad1628e530f68934628f6d7274a33dfccf650c8789011509669cfb3aa3902ae3031048561cbed82d3451917951550c1cc
SSDEEP 49152:w/OJDzD6CoNNGEADt7i+/yTukuFGNLrkBirx:EOMCichrSiGdkBirx
TLSH
T1DC06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\94B4.tmp
Size 3.6MB
SHA256 ffac70399de54f4d17b58d3eb912c89f905844878201d9f13ea0d81a89013128
MD5 863f619760b5e6d9a46b3626d300ace9
SHA1 2f76e354bb2094b312aae6b3b1cf59d62b969ce4
SHA512 78a30b886b0dba2699d217bbddd68539ff474c509193d3e1a2b0734266ea4e48fec868ba0738e9396693d023d3c58d459a86aed7ea0cf4054b168404db4aa394
SSDEEP 49152:w/OJDT4XsARCNGEADt7i+/yTukuFGNLrkBirx:EOl4X3ochrSiGdkBirx
TLSH
T1FD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9793.tmp

Path C:\Users\Admin\AppData\Local\Temp\9793.tmp
Size 3.6MB
SHA256 8238a6fd8737a10c21b9c0a0d5316f010ebb5b8259c892fa40f31527640c2d93
MD5 8b4bc949d3feb974769e4104583ec593
SHA1 1c4818253669dcbfa1713e537dd133617a37010e
SHA512 b7d4f1e997b7eaeb11f957da9411ab385003d2dbaab70cef86156d03c50154754fbd4ae83a79cafd2199f7863c2f3401e833254a6df932ec8539fcd3ca217751
SSDEEP 49152:w/OJDB3c/TgmNGEADt7i+/yTukuFGNLrkBirx:EOH3c/TPchrSiGdkBirx
TLSH
T15206831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9A62.tmp

Path C:\Users\Admin\AppData\Local\Temp\9A62.tmp
Size 3.6MB
SHA256 3e936b026f190f6881c1a32284217cd4eb6c92c6978441b4b63c4a6a9077b3a3
MD5 952f88b6f3675ebfd92293f73daa7f53
SHA1 5d71345fdbe9f487e310db5eb6ff73b8249d14a5
SHA512 16df9bb455c57759ac8e93eb6e462dc58c299b53a2d6cc7ad2211b1a898c483e91fdba1c340cf390bbf9ecff79870111f7f09a931314cdf615a253e67bde046f
SSDEEP 49152:w/OJDd5OsNGEADt7i+/yTukuFGNLrkBirx:EO4schrSiGdkBirx
TLSH
T1BD06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D11.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D11.tmp
Size 3.6MB
SHA256 34a075b5393feb605c2f723aa1557a28f9ee3073df76d69f48607ef07980ed55
MD5 e0f5050ae9d6f79a0b99516669166311
SHA1 8c65a234f88731c903bb18b18addba144deedbc8
SHA512 af74b5404f5dcca73913c000f731ce994ff08be555e4e73b2a3fa430a0982889299aae366417d338c279f25fb7c72c5889bc356b441f7f18b0dc009e2ad0a1aa
SSDEEP 49152:w/OJD3LrcpNGEADt7i+/yTukuFGNLrkBirx:EOZkchrSiGdkBirx
TLSH
T10D06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9FC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\9FC1.tmp
Size 3.6MB
SHA256 dce48a14ee410a2dfc13051e02890653ba8b1885a8ff5502df8d921091fb7fa7
MD5 d6ede3de7cece6b25e47a58b416893e5
SHA1 e3b95c2dc1b1c8815f622802fdf77c8225ff8e56
SHA512 f8edfec33e754f75d7c3bb302bb216bd29099fbf2f9850620ba91389455a9dd64b743eac755b0d06d6916f056c187a897603b922dd5cfb77a595ac24fa2b5cbb
SSDEEP 49152:w/OJDXaHdQ8qPNGEADt7i+/yTukuFGNLrkBirx:EOrPchrSiGdkBirx
TLSH
T1F606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A241.tmp

Path C:\Users\Admin\AppData\Local\Temp\A241.tmp
Size 3.6MB
SHA256 e865e4c15afbea6fd7b37f10631359fb38ce2963311108c16d09e74b4dfc08e2
MD5 5f0dec3301d16c45dcaedc738c1c96e7
SHA1 e0365e0f36130ff0bd2b2f3cc315149c72fabfb9
SHA512 9e17fac94ed18cd3f6bafd1dc3e16a9390fbeb35b38a97d24595e631830d43389168eee25f17a409262fb2923bd675f313a27227e62f7aa3e7876829182d3ed1
SSDEEP 49152:w/OJDEtzZ82sTNNGEADt7i+/yTukuFGNLrkBirx:EO2TfcNchrSiGdkBirx
TLSH
T13106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A520.tmp

Path C:\Users\Admin\AppData\Local\Temp\A520.tmp
Size 3.6MB
SHA256 07b2a1efe355a0410c9b0d4fb944d306054d1ef7c5f59961c747852842403633
MD5 d4edd56a032a223fd161849d6f393b87
SHA1 19b976c1ed8d91cbb1fc8e951d539842928c83c6
SHA512 7c70b65b93a9a66cccd2fb6e97984d5acc8e03ccfa10b513ab2b584241f0340cc650610bbbc3ee3a8b99309ad0f7cf43cf5ba4ddee3283b3e62ded72005a8fbd
SSDEEP 49152:w/OJDxDsfGtZNGEADt7i+/yTukuFGNLrkBirx:EOTDsfyZchrSiGdkBirx
TLSH
T19106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A7A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\A7A0.tmp
Size 3.6MB
SHA256 a7b66a3ef5c6a423692dd18acb06cb5b985d526cf39b26917755c0809017144c
MD5 7099d486600a5848887db4c4f2970a68
SHA1 e82817716f82a71947043c7d187c4518c3312d88
SHA512 7bd804e9c7bdf911544d9d2765249fe68e7e2f49cc61126eb437e59c86955d0f4cc650a30736966bb712725b97c83ac05711f4576bc31f8079bdc7ae171d7d39
SSDEEP 49152:w/OJDBKd59wOZNGEADt7i+/yTukuFGNLrkBirx:EOzgOEchrSiGdkBirx
TLSH
T15806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A8F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\A8F8.tmp
Size 3.6MB
SHA256 f4040d58449d1354e22584737b363eb37beeb2571d73d24193324252749c60ed
MD5 f078c46926ca7382d494db19d4a840cf
SHA1 e297ca2e5307422390742dd84dbc494c9a546d59
SHA512 71694d46241f09c09a69e4090f150671dfa3e59b7230b0e745536c0d09b82acc6cfe9c7e9227c68f5cb09202e6eaca6b21fbcc85d8f5aa4f9702c72c38eae441
SSDEEP 49152:w/OJDKaSPeVNGEADt7i+/yTukuFGNLrkBirx:EOcPeVchrSiGdkBirx
TLSH
T17106931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AC63.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC63.tmp
Size 3.6MB
SHA256 25efd458bbc43327bfd8f755cc24fb0b34cc784d3e4c637c8c23d9652bb64697
MD5 2125336d9113a98f00d12b2b9dfbb298
SHA1 17fe9d7e85cb1d7ea6842d18ce9fe150c3b3a32a
SHA512 86c8326f4505f899859deba13fbdd24aa0083ea48e4c884fb0d71ddec7c9305b40db4c20883a9b84f6e26742eafeee2b33d16df3820c51d1a576b86dbb46c599
SSDEEP 49152:w/OJDSdRQAVHtqNGEADt7i+/yTukuFGNLrkBirx:EOUdhVNqchrSiGdkBirx
TLSH
T1C106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AE18.tmp

Path C:\Users\Admin\AppData\Local\Temp\AE18.tmp
Size 3.6MB
SHA256 56b8dc66ce6da7c095ffee89bf49a305c831fa3f8786879fa90ecdc141b0427c
MD5 7f4b12a6373b6f2f1c89a570bf22c87e
SHA1 e60a152966c85152e2544aab7a1eb37c9e3374ff
SHA512 c7821884297830833704587eabe833794ece4e08f4cb0f02ba11fc0c476336a039ea0c469ed338a65d57f153255e8a13a744250d71c1b0c3e617fdafe3f9a0b1
SSDEEP 49152:w/OJDIplvTMJNGEADt7i+/yTukuFGNLrkBirx:EOWplvTMJchrSiGdkBirx
TLSH
T1B006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B01C.tmp

Path C:\Users\Admin\AppData\Local\Temp\B01C.tmp
Size 3.6MB
SHA256 0219669d6e903547cb54ea52971efbaf22863e8d871ff67835ecb0bce74c5a23
MD5 f529b96c2df3eda252f7d6395959f64c
SHA1 c245aa7db25a4c904704c886d53d9c764152f445
SHA512 425aa34cd0d877da3f0b67b9f21901bcdc56143f053f18ed8d13545b4b81df77b9267a0a72bd3655f8cc311edd18537ce4fac7cde878b293680864cf1b3e742f
SSDEEP 49152:w/OJD2SFMhTr9NGEADt7i+/yTukuFGNLrkBirx:EOYSFeBchrSiGdkBirx
TLSH
T1C706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B210.tmp

Path C:\Users\Admin\AppData\Local\Temp\B210.tmp
Size 3.6MB
SHA256 4032e8431cd58492fb7228ca2636181b93315fde26fe5b7c82eefb773f2752be
MD5 03a7a5f3789c15caa5f48df2d85e08d6
SHA1 92ba4efabf0c1f9f39ffa905d6febfe0693291ab
SHA512 f01c5684821b2f342486d2c04bbc1cf6d2b9af357ae43bbacf087c3dd6b01e3a18b083fee89aeae74a3608f6979280c7cf3d3e9d92a605ea0e84da944bf7e2fa
SSDEEP 49152:w/OJDT3ONGEADt7i+/yTukuFGNLrkBirx:EOl3OchrSiGdkBirx
TLSH
T1D706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B51D.tmp

Path C:\Users\Admin\AppData\Local\Temp\B51D.tmp
Size 3.6MB
SHA256 fd7e52da75a7fdb435c4e8f80ca980ba8207826f993fa67fe6326dfea50fbfe5
MD5 c3004cb09d9d3b77262ac55659919b22
SHA1 b73f8c598c8dc5058564eddfced60d706b1ffba4
SHA512 9ef957ce22834bc46b00b0a2e211291269057e88041cc739857156be656b86db40f9a1525e4b72582450089729fda2560503afbe5ad10124774050e4f8319120
SSDEEP 49152:w/OJDcGNzkVNGEADt7i+/yTukuFGNLrkBirx:EOOchrSiGdkBirx
TLSH
T10E06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B675.tmp

Path C:\Users\Admin\AppData\Local\Temp\B675.tmp
Size 3.6MB
SHA256 32ac8885ed7cfe5e86418bc0aef6246da2d44d21fe5291fc64b1c04127cd6434
MD5 ef5ff99a84f226b9c51454d67c6a0ff0
SHA1 791e94c267a76cafda6f51de5745e2b384cc0382
SHA512 fd7bc98f5a1bec102831a57e7627452771fece186e1b6e2975f20363e8dca2a24945ddad74dd24055384b8f1fbcb21a877428657553f2af3241f811e54a6714b
SSDEEP 49152:w/OJDLpEvNNGEADt7i+/yTukuFGNLrkBirx:EObEFchrSiGdkBirx
TLSH
T16D06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B7CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\B7CD.tmp
Size 3.6MB
SHA256 37419a27826b8e6377d9667bc80403fbc32f8e2548f20b5e636e6662eab47b88
MD5 e00fb07f0102e1009817c2a20917163d
SHA1 61d599002923ea3fb9d5f041b8248712142f4221
SHA512 6c9bcf893fee61e6de00e23d3db2595d866c937a3a8152f92a12de713f432098fa6432f04090e7322d77ac4919c11501f284b9843eb24623ea995965ef054b0e
SSDEEP 49152:w/OJD81NNGEADt7i+/yTukuFGNLrkBirx:EO6chrSiGdkBirx
TLSH
T18206931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-7-0x00000000005C0000-0x0000000000643000-memory.dmp

Download

memory/936-0-0x00000000005C0000-0x0000000000643000-memory.dmp

Download

memory/960-153-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/960-147-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1108-203-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/1108-195-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/1116-238-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/1116-234-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/1276-194-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/1276-187-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/1300-5-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/1300-14-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/1676-166-0x00000000000A0000-0x0000000000123000-memory.dmp

Download

memory/1676-175-0x00000000000A0000-0x0000000000123000-memory.dmp

Download

memory/1732-125-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/1732-133-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/1772-298-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/2376-201-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2376-210-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2432-233-0x00000000003B0000-0x0000000000433000-memory.dmp

Download

memory/2432-228-0x00000000003B0000-0x0000000000433000-memory.dmp

Download

memory/2480-258-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2480-253-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2500-26-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/2500-34-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/2552-48-0x0000000000320000-0x00000000003A3000-memory.dmp

Download

memory/2552-40-0x0000000000320000-0x00000000003A3000-memory.dmp

Download

memory/2592-63-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/2592-54-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/2620-21-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/2620-12-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/2844-75-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2844-83-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2852-159-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/2852-167-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/2904-181-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/2904-173-0x0000000000FD0000-0x0000000001053000-memory.dmp

Download

memory/2916-152-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/2916-160-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/3056-111-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/3056-104-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/3088-55-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/3088-47-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/3128-91-0x0000000000490000-0x0000000000513000-memory.dmp

Download

memory/3128-82-0x0000000000490000-0x0000000000513000-memory.dmp

Download

memory/3284-292-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/3284-299-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/3464-224-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/3464-215-0x0000000001000000-0x0000000001083000-memory.dmp

Download

memory/3484-61-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/3484-69-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/3600-89-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/3600-96-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/3804-229-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3804-222-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3900-188-0x00000000001F0000-0x0000000000273000-memory.dmp

Download

memory/3900-180-0x00000000001F0000-0x0000000000273000-memory.dmp

Download

memory/4400-272-0x0000000000A10000-0x0000000000A93000-memory.dmp

Download

memory/4400-268-0x0000000000A10000-0x0000000000A93000-memory.dmp

Download

memory/4444-278-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/4444-273-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/4472-283-0x0000000000860000-0x00000000008E3000-memory.dmp

Download

memory/4472-277-0x0000000000860000-0x00000000008E3000-memory.dmp

Download

memory/4676-293-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/4676-288-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/4712-303-0x0000000000CD0000-0x0000000000D53000-memory.dmp

Download

memory/5080-297-0x00000000005E0000-0x0000000000663000-memory.dmp

Download

memory/5080-248-0x00000000005E0000-0x0000000000663000-memory.dmp

Download

memory/5148-19-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/5148-27-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/5264-110-0x0000000000090000-0x0000000000113000-memory.dmp

Download

memory/5264-117-0x0000000000090000-0x0000000000113000-memory.dmp

Download

memory/5588-118-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5588-124-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5632-138-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/5632-145-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/5780-244-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/5780-249-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/5808-131-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/5808-139-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/5820-243-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/5820-239-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/5860-263-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/5860-267-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/5864-208-0x0000000000830000-0x00000000008B3000-memory.dmp

Download

memory/5864-217-0x0000000000830000-0x00000000008B3000-memory.dmp

Download

memory/5916-41-0x0000000000940000-0x00000000009C3000-memory.dmp

Download

memory/5916-33-0x0000000000940000-0x00000000009C3000-memory.dmp

Download

memory/5924-97-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/5924-103-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/5968-68-0x0000000000600000-0x0000000000683000-memory.dmp

Download

memory/5968-77-0x0000000000600000-0x0000000000683000-memory.dmp

Download

memory/5980-282-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/5980-287-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/6012-257-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/6012-262-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads