ce60610d14d64e704eeb9eaffa8d8113806c0ce7cbe2d63b6ae5513fa930ee29

Analysis

max time kernel
136s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d2344291230935b00c394f85dedc6ecb_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260728-wt21asel4w
SHA256 ce60610d14d64e704eeb9eaffa8d8113806c0ce7cbe2d63b6ae5513fa930ee29
MD5 d2344291230935b00c394f85dedc6ecb
SHA1 0599c870cd641697894277e462f7b0dacfe83a94
SHA512 d1954b4c0e251cc5e8db2ca26af7b7095a4afc07eb072906fac1f9c175e44ae4ba3eb960b928747569bbb4e37eed2574d78f1bc9c81e4b95cd12c1e9c7d5e808
SSDEEP 49152:w/OJD47zFXNGEADt7i+/yTukuFGNLrkBirx:EOCtXchrSiGdkBirx
TLSH
T16406931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2736	5D49.tmp
4280	6095.tmp
6048	64CB.tmp
4224	65E4.tmp
5212	6B14.tmp
1196	6E50.tmp
4604	71BB.tmp
5356	74F7.tmp
2036	7834.tmp
5104	7A37.tmp
4536	7E7D.tmp
5940	811D.tmp
4188	82D2.tmp
2816	83DC.tmp
1512	8514.tmp
1100	862E.tmp
1236	8737.tmp
3900	8822.tmp
5948	88FC.tmp
2580	89E7.tmp
1160	8AC2.tmp
2408	8B7D.tmp
4880	8C39.tmp
2428	8D13.tmp
3552	8DEE.tmp
3020	8EAA.tmp
5260	8F84.tmp
5372	9030.tmp
4996	90CC.tmp
4656	9169.tmp
3388	9234.tmp
1824	92E0.tmp
5516	93BA.tmp
1812	94B4.tmp
4496	959F.tmp
3684	967A.tmp
3628	9764.tmp
4592	98BC.tmp
3960	99A6.tmp
2188	9AA0.tmp
4500	9B4C.tmp
2420	9C56.tmp
6068	9D50.tmp
3788	9E59.tmp
1376	9F53.tmp
5488	A02E.tmp
4128	A147.tmp
2060	A212.tmp
3116	A2CE.tmp
5228	A389.tmp
4780	A493.tmp
5876	A55E.tmp
2444	A60A.tmp
3468	A6C5.tmp
5552	A781.tmp
2900	A83C.tmp
4544	A8E8.tmp
1504	A9A4.tmp
5688	AA5F.tmp
5560	AB2A.tmp
5048	ABD6.tmp
3428	ACB1.tmp
2108	AD6D.tmp
2868	AE47.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D24A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C23D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28E6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B131.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC5C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3351.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A7E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A60A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DEE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8E8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B2A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	420B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B24.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F03D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C961.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5E4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3440.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38E4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83A8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B7AE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBBB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D87.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8EA5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B9CC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BC8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D50.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDCF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9EE1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E0F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45DF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59D4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B23F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5853.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E17D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	433.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F9A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0BF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9442.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C72A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11B0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C79.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B2FA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C7AB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E47A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FEF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19E2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FF31.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	617.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9E59.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B953.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E99B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E1B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D1E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E72.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB00.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D69F.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 2736	5836	2026-07-28_d2344291230935b00c394f85dedc6ecb_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 2736 wrote to memory of 4280	2736	5D49.tmp	90
PID 4280 wrote to memory of 6048	4280	6095.tmp	91
PID 6048 wrote to memory of 4224	6048	64CB.tmp	92
PID 4224 wrote to memory of 5212	4224	65E4.tmp	93
PID 5212 wrote to memory of 1196	5212	6B14.tmp	94
PID 1196 wrote to memory of 4604	1196	6E50.tmp	95
PID 4604 wrote to memory of 5356	4604	71BB.tmp	96
PID 5356 wrote to memory of 2036	5356	74F7.tmp	97
PID 2036 wrote to memory of 5104	2036	7834.tmp	98
PID 5104 wrote to memory of 4536	5104	7A37.tmp	99
PID 4536 wrote to memory of 5940	4536	7E7D.tmp	100
PID 5940 wrote to memory of 4188	5940	811D.tmp	101
PID 4188 wrote to memory of 2816	4188	82D2.tmp	102
PID 2816 wrote to memory of 1512	2816	83DC.tmp	103
PID 1512 wrote to memory of 1100	1512	8514.tmp	104
PID 1100 wrote to memory of 1236	1100	862E.tmp	105
PID 1236 wrote to memory of 3900	1236	8737.tmp	106
PID 3900 wrote to memory of 5948	3900	8822.tmp	107
PID 5948 wrote to memory of 2580	5948	88FC.tmp	108
PID 2580 wrote to memory of 1160	2580	89E7.tmp	109
PID 1160 wrote to memory of 2408	1160	8AC2.tmp	110
PID 2408 wrote to memory of 4880	2408	8B7D.tmp	111
PID 4880 wrote to memory of 2428	4880	8C39.tmp	112
PID 2428 wrote to memory of 3552	2428	8D13.tmp	113
PID 3552 wrote to memory of 3020	3552	8DEE.tmp	114
PID 3020 wrote to memory of 5260	3020	8EAA.tmp	115
PID 5260 wrote to memory of 5372	5260	8F84.tmp	116
PID 5372 wrote to memory of 4996	5372	9030.tmp	117
PID 4996 wrote to memory of 4656	4996	90CC.tmp	118
PID 4656 wrote to memory of 3388	4656	9169.tmp	119
PID 3388 wrote to memory of 1824	3388	9234.tmp	120
PID 1824 wrote to memory of 5516	1824	92E0.tmp	121
PID 5516 wrote to memory of 1812	5516	93BA.tmp	122
PID 1812 wrote to memory of 4496	1812	94B4.tmp	123
PID 4496 wrote to memory of 3684	4496	959F.tmp	124
PID 3684 wrote to memory of 3628	3684	967A.tmp	125
PID 3628 wrote to memory of 4592	3628	9764.tmp	126
PID 4592 wrote to memory of 3960	4592	98BC.tmp	127
PID 3960 wrote to memory of 2188	3960	99A6.tmp	128
PID 2188 wrote to memory of 4500	2188	9AA0.tmp	129
PID 4500 wrote to memory of 2420	4500	9B4C.tmp	130
PID 2420 wrote to memory of 6068	2420	9C56.tmp	131
PID 6068 wrote to memory of 3788	6068	9D50.tmp	132
PID 3788 wrote to memory of 1376	3788	9E59.tmp	133
PID 1376 wrote to memory of 5488	1376	9F53.tmp	134
PID 5488 wrote to memory of 4128	5488	A02E.tmp	135
PID 4128 wrote to memory of 2060	4128	A147.tmp	136
PID 2060 wrote to memory of 3116	2060	A212.tmp	137
PID 3116 wrote to memory of 5228	3116	A2CE.tmp	138
PID 5228 wrote to memory of 4780	5228	A389.tmp	139
PID 4780 wrote to memory of 5876	4780	A493.tmp	140
PID 5876 wrote to memory of 2444	5876	A55E.tmp	141
PID 2444 wrote to memory of 3468	2444	A60A.tmp	142
PID 3468 wrote to memory of 5552	3468	A6C5.tmp	143
PID 5552 wrote to memory of 2900	5552	A781.tmp	144
PID 2900 wrote to memory of 4544	2900	A83C.tmp	145
PID 4544 wrote to memory of 1504	4544	A8E8.tmp	146
PID 1504 wrote to memory of 5688	1504	A9A4.tmp	147
PID 5688 wrote to memory of 5560	5688	AA5F.tmp	148
PID 5560 wrote to memory of 5048	5560	AB2A.tmp	149
PID 5048 wrote to memory of 3428	5048	ABD6.tmp	150
PID 3428 wrote to memory of 2108	3428	ACB1.tmp	151
PID 2108 wrote to memory of 2868	2108	AD6D.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d2344291230935b00c394f85dedc6ecb_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d2344291230935b00c394f85dedc6ecb_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\Temp\5D49.tmp
  "C:\Users\Admin\AppData\Local\Temp\5D49.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\6095.tmp
    "C:\Users\Admin\AppData\Local\Temp\6095.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\64CB.tmp
      "C:\Users\Admin\AppData\Local\Temp\64CB.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\65E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65E4.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\6B14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B14.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\6E50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E50.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\71BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71BB.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\74F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74F7.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\7834.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7834.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\7A37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A37.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\7E7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\811D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\811D.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\82D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82D2.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\83DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83DC.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\8514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8514.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\862E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\862E.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\8737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8737.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\8822.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8822.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\88FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88FC.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\89E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89E7.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\8AC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\8B7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\8C39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C39.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\8D13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D13.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\8DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\8EAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\8F84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F84.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\9030.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9030.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\90CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90CC.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\9169.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9169.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\9234.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9234.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\92E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92E0.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\93BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93BA.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\94B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B4.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\959F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\959F.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\967A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\967A.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\9764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9764.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\98BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98BC.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\99A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99A6.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\9AA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\9B4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\9C56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C56.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\9D50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D50.tmp"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\9E59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E59.tmp"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\9F53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F53.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\A02E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A02E.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\A147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A147.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\A212.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A212.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\A2CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\A389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A389.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\A493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A493.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\A55E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A55E.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\A60A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A60A.tmp"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\A6C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\A781.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A781.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\A83C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A83C.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\A8E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\A9A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\AA5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\AB2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\ABD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\ACB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\AD6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\AE47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE47.tmp"
        65⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\AF41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF41.tmp"
        66⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\B00C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B00C.tmp"
        67⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\B0C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"
        68⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\B174.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B174.tmp"
        69⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\B23F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B23F.tmp"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\B2FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\B3C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"
        72⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\B471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B471.tmp"
        73⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\B53D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B53D.tmp"
        74⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\B608.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B608.tmp"
        75⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\B6C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"
        76⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\B7AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\B879.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B879.tmp"
        78⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\B953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B953.tmp"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\B9FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"
        80⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\BABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BABB.tmp"
        81⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\BB76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB76.tmp"
        82⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\BC32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC32.tmp"
        83⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\BD0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"
        84⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\BE16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE16.tmp"
        85⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\BEE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"
        86⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\BFDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"
        87⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\C0A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"
        88⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\C162.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C162.tmp"
        89⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\C23D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C23D.tmp"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\C317.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C317.tmp"
        91⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\C3C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"
        92⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\C47F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C47F.tmp"
        93⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\C53A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C53A.tmp"
        94⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\C615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C615.tmp"
        95⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\C6D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"
        96⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\C7AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\C896.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C896.tmp"
        98⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\C961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C961.tmp"
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\CA0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"
        100⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\CAB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"
        101⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\CB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB74.tmp"
        102⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\CC20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC20.tmp"
        103⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\CCEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\CDC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"
        105⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\CE91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE91.tmp"
        106⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\CF5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"
        107⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\D018.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D018.tmp"
        108⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\D0D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0D3.tmp"
        109⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\D18F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D18F.tmp"
        110⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\D24A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D24A.tmp"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\D306.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D306.tmp"
        112⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\D3C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"
        113⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\D47D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D47D.tmp"
        114⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\D528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D528.tmp"
        115⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\D5E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\D69F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D69F.tmp"
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\D74B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D74B.tmp"
        118⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\D807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D807.tmp"
        119⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\D8E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"
        120⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\D9AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"
        121⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\DA78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA78.tmp"
        122⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\DB62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB62.tmp"
        123⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\DBFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"
        124⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\DCCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"
        125⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\DD85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD85.tmp"
        126⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\DE41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE41.tmp"
        127⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\DF1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"
        128⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\DFD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"
        129⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\E0B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"
        130⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\E17D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E17D.tmp"
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\E238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E238.tmp"
        132⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\E313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E313.tmp"
        133⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\E3CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"
        134⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\E47A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E47A.tmp"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\E536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E536.tmp"
        136⤵
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\E5F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"
        137⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\E6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"
        138⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\E768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E768.tmp"
        139⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\E824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E824.tmp"
        140⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\E8DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"
        141⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\E99B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E99B.tmp"
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\EA56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA56.tmp"
        143⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\EB02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB02.tmp"
        144⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\EBCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBCD.tmp"
        145⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\EC89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC89.tmp"
        146⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\ED44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED44.tmp"
        147⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\EE00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE00.tmp"
        148⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\EEAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"
        149⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\EF67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF67.tmp"
        150⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\F013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F013.tmp"
        151⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\F0BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\F18A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F18A.tmp"
        153⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\F255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F255.tmp"
        154⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\F320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F320.tmp"
        155⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\F3DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"
        156⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\F4A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"
        157⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\F572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F572.tmp"
        158⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\F61E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F61E.tmp"
        159⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\F6CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"
        160⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\F776.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F776.tmp"
        161⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\F822.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F822.tmp"
        162⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\F8DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"
        163⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\F999.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F999.tmp"
        164⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\FA54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA54.tmp"
        165⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\FB00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB00.tmp"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\FBBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\FC77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC77.tmp"
        168⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\FD23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD23.tmp"
        169⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\FDCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\FE7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"
        171⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\FF26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF26.tmp"
        172⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\FFE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"
        173⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E.tmp"
        174⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\13A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13A.tmp"
        175⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\1E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E6.tmp"
        176⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        177⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\34D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D.tmp"
        178⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\3F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F9.tmp"
        179⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4.tmp"
        180⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\57F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57F.tmp"
        181⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\679.tmp"
        182⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\764.tmp"
        183⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\87D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87D.tmp"
        184⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\996.tmp"
        185⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A90.tmp"
        186⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\B6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6B.tmp"
        187⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\C46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46.tmp"
        188⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D11.tmp"
        189⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1B.tmp"
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE6.tmp"
        191⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEF.tmp"
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\10F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10F9.tmp"
        193⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\11F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11F3.tmp"
        194⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\12DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12DD.tmp"
        195⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\13D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13D7.tmp"
        196⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\14C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14C2.tmp"
        197⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\15CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15CB.tmp"
        198⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\16C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16C5.tmp"
        199⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\17BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17BF.tmp"
        200⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\18E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18E8.tmp"
        201⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\19E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19E2.tmp"
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\1B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\1C24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C24.tmp"
        204⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\1D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\1E18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E18.tmp"
        206⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\1EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"
        207⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\1FCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"
        208⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\20B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20B8.tmp"
        209⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\2193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2193.tmp"
        210⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\22BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22BC.tmp"
        211⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\23F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F4.tmp"
        212⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\24B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24B0.tmp"
        213⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\258B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\258B.tmp"
        214⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\2636.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2636.tmp"
        215⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\2702.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2702.tmp"
        216⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\27EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27EC.tmp"
        217⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\28E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28E6.tmp"
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\29F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29F0.tmp"
        219⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\2AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"
        220⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\2BE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"
        221⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\2CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"
        222⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\2DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"
        223⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\2ED2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ED2.tmp"
        224⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\2FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"
        225⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\3097.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3097.tmp"
        226⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\31A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31A0.tmp"
        227⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\327B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\327B.tmp"
        228⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\3385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3385.tmp"
        229⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\3440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3440.tmp"
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\354A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\354A.tmp"
        231⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\3653.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3653.tmp"
        232⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\372E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\372E.tmp"
        233⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\3819.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3819.tmp"
        234⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\38E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38E4.tmp"
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\39DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39DE.tmp"
        236⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\3AD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"
        237⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\3BB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BB2.tmp"
        238⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\3CBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"
        239⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\3D87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D87.tmp"
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\3E72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E72.tmp"
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\3F4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"
        242⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\4027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4027.tmp"
        243⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\4102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4102.tmp"
        244⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\420B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\420B.tmp"
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\42F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42F6.tmp"
        246⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\440F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440F.tmp"
        247⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\44EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44EA.tmp"
        248⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\45C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C5.tmp"
        249⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\469F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\469F.tmp"
        250⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\478A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\478A.tmp"
        251⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\4874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4874.tmp"
        252⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\493F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\493F.tmp"
        253⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\4A39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A39.tmp"
        254⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\4B24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B24.tmp"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\4BEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BEF.tmp"
        256⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\4D66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D66.tmp"
        257⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\4E40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E40.tmp"
        258⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\4F4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"
        259⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\5006.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5006.tmp"
        260⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\50E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50E0.tmp"
        261⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\51BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51BB.tmp"
        262⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\5296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5296.tmp"
        263⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\5332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5332.tmp"
        264⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\53EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53EE.tmp"
        265⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\54C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54C8.tmp"
        266⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\55F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55F1.tmp"
        267⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\56CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56CC.tmp"
        268⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\5787.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5787.tmp"
        269⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\5853.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5853.tmp"
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\593D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\593D.tmp"
        271⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\5A08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A08.tmp"
        272⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\5AB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"
        273⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\5B7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B7F.tmp"
        274⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\5C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C79.tmp"
        275⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\5D63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D63.tmp"
        276⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\5E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"
        277⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\5EFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"
        278⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\5FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"
        279⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\60A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60A0.tmp"
        280⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\618A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\618A.tmp"
        281⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\6274.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6274.tmp"
        282⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\633F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\633F.tmp"
        283⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\6821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6821.tmp"
        284⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\68ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68ED.tmp"
        285⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\69A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69A8.tmp"
        286⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\6A54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A54.tmp"
        287⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\6B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B4E.tmp"
        288⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\6CA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"
        289⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\6D61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D61.tmp"
        290⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\6E1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E1D.tmp"
        291⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\6F26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F26.tmp"
        292⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\7001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7001.tmp"
        293⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\70CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70CC.tmp"
        294⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\71B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71B7.tmp"
        295⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\7291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7291.tmp"
        296⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\734D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\734D.tmp"
        297⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\73F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73F9.tmp"
        298⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\7502.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7502.tmp"
        299⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\75ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75ED.tmp"
        300⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\76C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76C7.tmp"
        301⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\77B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77B2.tmp"
        302⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\788D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\788D.tmp"
        303⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\7958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7958.tmp"
        304⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\7A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A42.tmp"
        305⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\7B3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"
        306⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\7C17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C17.tmp"
        307⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\7D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D11.tmp"
        308⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\7E1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"
        309⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\7EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"
        310⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\800E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800E.tmp"
        311⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\8118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8118.tmp"
        312⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\81E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81E3.tmp"
        313⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\82DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82DD.tmp"
        314⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\83A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83A8.tmp"
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\84A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84A2.tmp"
        316⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\855E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\855E.tmp"
        317⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\8696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8696.tmp"
        318⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\8771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8771.tmp"
        319⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\887B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\887B.tmp"
        320⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\8975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8975.tmp"
        321⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\8A4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"
        322⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\8AFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"
        323⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\8BF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BF5.tmp"
        324⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\8CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"
        325⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\8D4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"
        326⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\8DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DF9.tmp"
        327⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\8EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA5.tmp"
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\8F8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F8F.tmp"
        329⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\905A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905A.tmp"
        330⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\9125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9125.tmp"
        331⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\91C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91C2.tmp"
        332⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\92AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92AC.tmp"
        333⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\9377.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9377.tmp"
        334⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\9442.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9442.tmp"
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\952D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\952D.tmp"
        336⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\9627.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9627.tmp"
        337⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\9730.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9730.tmp"
        338⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\984A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\984A.tmp"
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\9915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9915.tmp"
        340⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\99E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E0.tmp"
        341⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\9ACA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"
        342⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\9B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B95.tmp"
        343⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\9C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C51.tmp"
        344⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\9CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"
        345⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\9DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DE7.tmp"
        346⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\9EE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EE1.tmp"
        347⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\9FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FBC.tmp"
        348⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\A0A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"
        349⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\A1B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"
        350⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\A29A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A29A.tmp"
        351⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\A394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A394.tmp"
        352⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\A450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A450.tmp"
        353⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\A50B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A50B.tmp"
        354⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\A5E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5E6.tmp"
        355⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\A6D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"
        356⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\A7BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"
        357⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\A8B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"
        358⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\A98F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A98F.tmp"
        359⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\AA7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"
        360⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\AB26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB26.tmp"
        361⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\AC5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC5E.tmp"
        362⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\AD49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD49.tmp"
        363⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\AE14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE14.tmp"
        364⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\AF0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"
        365⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\AFBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFBA.tmp"
        366⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\B085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B085.tmp"
        367⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\B131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B131.tmp"
        368⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\B1EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1EC.tmp"
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\B2B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2B7.tmp"
        370⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\B3C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3C1.tmp"
        371⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\B4EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4EA.tmp"
        372⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\B596.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B596.tmp"
        373⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\B670.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B670.tmp"
        374⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\B72C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B72C.tmp"
        375⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\B807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B807.tmp"
        376⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\B8E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8E1.tmp"
        377⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\B9CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9CC.tmp"
        378⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\BA78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA78.tmp"
        379⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\BB72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB72.tmp"
        380⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\BC5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC5C.tmp"
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\BD46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD46.tmp"
        382⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\BE40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE40.tmp"
        383⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\BEFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEFC.tmp"
        384⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\BFC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFC7.tmp"
        385⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\C073.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C073.tmp"
        386⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\C13E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C13E.tmp"
        387⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\C276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C276.tmp"
        388⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\C3AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3AF.tmp"
        389⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\C46A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46A.tmp"
        390⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\C564.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C564.tmp"
        391⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\C64F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C64F.tmp"
        392⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\C72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C72A.tmp"
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\C804.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C804.tmp"
        394⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\C8DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8DF.tmp"
        395⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\C9F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9F8.tmp"
        396⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\CAD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAD3.tmp"
        397⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\CBDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBDD.tmp"
        398⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\CCB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCB7.tmp"
        399⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\CDB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB1.tmp"
        400⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\CE9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE9C.tmp"
        401⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        402⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\D042.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D042.tmp"
        403⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\D13C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D13C.tmp"
        404⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\D226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D226.tmp"
        405⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\D330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D330.tmp"
        406⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\D3DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3DC.tmp"
        407⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\D4D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4D6.tmp"
        408⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\D5C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5C0.tmp"
        409⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\D6D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6D9.tmp"
        410⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\D795.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D795.tmp"
        411⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\D86F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D86F.tmp"
        412⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\D92B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D92B.tmp"
        413⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\D9F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9F6.tmp"
        414⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\DAF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAF0.tmp"
        415⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\DBBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBBB.tmp"
        416⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\DCC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCC5.tmp"
        417⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\DD90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD90.tmp"
        418⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\DE8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8A.tmp"
        419⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\DF74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF74.tmp"
        420⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\E03F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E03F.tmp"
        421⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\E10B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E10B.tmp"
        422⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\E1E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1E5.tmp"
        423⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\E2A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2A1.tmp"
        424⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\E38B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E38B.tmp"
        425⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\E476.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E476.tmp"
        426⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\E58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E58F.tmp"
        427⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\E679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E679.tmp"
        428⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\E754.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E754.tmp"
        429⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\E84E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E84E.tmp"
        430⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\E929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E929.tmp"
        431⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\EA13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA13.tmp"
        432⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\EAEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAEE.tmp"
        433⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\EBB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBB9.tmp"
        434⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\EC74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC74.tmp"
        435⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\ED7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED7E.tmp"
        436⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\EE59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE59.tmp"
        437⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\EF34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF34.tmp"
        438⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\F03D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F03D.tmp"
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\F147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F147.tmp"
        440⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\F231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F231.tmp"
        441⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\F2FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2FC.tmp"
        442⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\F3C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3C7.tmp"
        443⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\F473.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F473.tmp"
        444⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\F53E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F53E.tmp"
        445⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\F677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F677.tmp"
        446⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\F761.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F761.tmp"
        447⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\F907.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F907.tmp"
        448⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\F9C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9C3.tmp"
        449⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\FA7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA7E.tmp"
        450⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\FB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB49.tmp"
        451⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\FC43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC43.tmp"
        452⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\FD5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD5D.tmp"
        453⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\FE57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE57.tmp"
        454⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\FF31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF31.tmp"
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\FFFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFFC.tmp"
        456⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99.tmp"
        457⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\193.tmp"
        458⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\28D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D.tmp"
        459⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348.tmp"
        460⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\433.tmp"
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\52D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D.tmp"
        462⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617.tmp"
        463⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\701.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\701.tmp"
        464⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\869.tmp"
        465⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\943.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\943.tmp"
        466⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\A6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6C.tmp"
        467⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B47.tmp"
        468⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C51.tmp"
        469⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0C.tmp"
        470⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE7.tmp"
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF1.tmp"
        472⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBC.tmp"
        473⤵
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\10D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10D5.tmp"
        474⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\11B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11B0.tmp"
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\13B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13B3.tmp"
        477⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\148E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\148E.tmp"
        478⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\154A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\154A.tmp"
        479⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\1663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1663.tmp"
        480⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\171E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\171E.tmp"
        481⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\1828.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1828.tmp"
        482⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\1932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1932.tmp"
        483⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\1A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A99.tmp"
        484⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\1BD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BD1.tmp"
        485⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\1CAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CAC.tmp"
        486⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\1D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D97.tmp"
        487⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\1EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EA0.tmp"
        488⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\1F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9A.tmp"
        489⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\20D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20D3.tmp"
        490⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\219E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\219E.tmp"
        491⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\22B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22B7.tmp"
        492⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\2382.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2382.tmp"
        493⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\244D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\244D.tmp"
        494⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\2509.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2509.tmp"
        495⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\25D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25D4.tmp"
        496⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\26AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26AF.tmp"
        497⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\277A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\277A.tmp"
        498⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\2883.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2883.tmp"
        499⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\297D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\297D.tmp"
        500⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\2A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A58.tmp"
        501⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\2B52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B52.tmp"
        502⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\2C1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C1D.tmp"
        503⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\2CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CD9.tmp"
        504⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\2DF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DF2.tmp"
        505⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\2EDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EDC.tmp"
        506⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\2FC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"
        507⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\30C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30C1.tmp"
        508⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\31AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31AB.tmp"
        509⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\3257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3257.tmp"
        510⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\3351.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3351.tmp"
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\345B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\345B.tmp"
        512⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\3535.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3535.tmp"
        513⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\3610.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3610.tmp"
        514⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\36EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36EB.tmp"
        515⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\37A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37A6.tmp"
        516⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\3881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3881.tmp"
        517⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\398B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\398B.tmp"
        518⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\3AB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AB4.tmp"
        519⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\3B9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B9E.tmp"
        520⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\3C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C79.tmp"
        521⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\3D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D44.tmp"
        522⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\3E0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E0F.tmp"
        523⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\3F09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F09.tmp"
        524⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\3FB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FB5.tmp"
        525⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\40AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40AF.tmp"
        526⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\4199.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4199.tmp"
        527⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\4236.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4236.tmp"
        528⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\4310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4310.tmp"
        529⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\441A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\441A.tmp"
        530⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\4514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4514.tmp"
        531⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\45DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45DF.tmp"
        532⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\469B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\469B.tmp"
        533⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\47B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47B4.tmp"
        534⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\487F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\487F.tmp"
        535⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\4989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4989.tmp"
        536⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\4A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A73.tmp"
        537⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\4B6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B6D.tmp"
        538⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\4C48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C48.tmp"
        539⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\4D32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D32.tmp"
        540⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\4E2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E2C.tmp"
        541⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\4F07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F07.tmp"
        542⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\4FE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE2.tmp"
        543⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\508D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\508D.tmp"
        544⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\5178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5178.tmp"
        545⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\5253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5253.tmp"
        546⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\534D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\534D.tmp"
        547⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\5408.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5408.tmp"
        548⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\54C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54C4.tmp"
        549⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\55CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55CD.tmp"
        550⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\56A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56A8.tmp"
        551⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\5763.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5763.tmp"
        552⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\583E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\583E.tmp"
        553⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\5909.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5909.tmp"
        554⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\59D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59D4.tmp"
        555⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\5AEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AEE.tmp"
        556⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\5BC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BC8.tmp"
        557⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\5CC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CC2.tmp"
        558⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\5D9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D9D.tmp"
        559⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\5EB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EB6.tmp"
        560⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\5F82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F82.tmp"
        561⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\604D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\604D.tmp"
        562⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\6127.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6127.tmp"
        563⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\6231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6231.tmp"
        564⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\632B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\632B.tmp"
        565⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\6444.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6444.tmp"
        566⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\650F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\650F.tmp"
        567⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\65EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65EA.tmp"
        568⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\6723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6723.tmp"
        569⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\67CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67CF.tmp"
        570⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\688A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\688A.tmp"
        571⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\6984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6984.tmp"
        572⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\6A7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A7E.tmp"
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\6B68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B68.tmp"
        574⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\6C24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C24.tmp"
        575⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\6CFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CFF.tmp"
        576⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\6E18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E18.tmp"
        577⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\6F22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F22.tmp"
        578⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\700C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\700C.tmp"
        579⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\70E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70E7.tmp"
        580⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\71B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71B2.tmp"
        581⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\728D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\728D.tmp"
        582⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\7367.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7367.tmp"
        583⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\7452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7452.tmp"
        584⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\74EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74EE.tmp"
        585⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\75C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75C9.tmp"
        586⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\7694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7694.tmp"
        587⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\775F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\775F.tmp"
        588⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\782A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\782A.tmp"
        589⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\78C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78C6.tmp"
        590⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\79B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79B1.tmp"
        591⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\7A4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A4D.tmp"
        592⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\7B08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B08.tmp"
        593⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\7BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BC4.tmp"
        594⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\7C9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"
        595⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\7D6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"
        596⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\7E45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E45.tmp"
        597⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\7F8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F8D.tmp"
        598⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\8058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8058.tmp"
        599⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\8104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8104.tmp"
        600⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\81EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81EE.tmp"
        601⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\82AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82AA.tmp"
        602⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\8375.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8375.tmp"
        603⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\844F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\844F.tmp"
        604⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\852A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\852A.tmp"
        605⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\85F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85F5.tmp"
        606⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\871E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\871E.tmp"
        607⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\8828.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8828.tmp"
        608⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\8941.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8941.tmp"
        609⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\89FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89FD.tmp"
        610⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\8AA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AA8.tmp"
        611⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\8B74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B74.tmp"
        612⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\8C1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C1F.tmp"
        613⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\8CEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CEB.tmp"
        614⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\8E13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E13.tmp"
        615⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\8ECF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ECF.tmp"
        616⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\8FC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FC9.tmp"
        617⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\90F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90F2.tmp"
        618⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\91FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91FB.tmp"
        619⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\92B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92B7.tmp"
        620⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\9363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9363.tmp"
        621⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\942E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\942E.tmp"
        622⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\9528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9528.tmp"
        623⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\9603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9603.tmp"
        624⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\96BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96BE.tmp"
        625⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\9864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9864.tmp"
        626⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\99AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99AC.tmp"
        627⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\9AC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AC5.tmp"
        628⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\9BBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BBF.tmp"
        629⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\9C5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C5C.tmp"
        630⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\9D75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D75.tmp"
        631⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\9E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E6F.tmp"
        632⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\9F69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F69.tmp"
        633⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\A063.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A063.tmp"
        634⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\A14D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A14D.tmp"
        635⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\A238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A238.tmp"
        636⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\A332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A332.tmp"
        637⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\A43B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A43B.tmp"
        638⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\A545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A545.tmp"
        639⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\A620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A620.tmp"
        640⤵
        
        PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5D49.tmp

Path C:\Users\Admin\AppData\Local\Temp\5D49.tmp
Size 3.6MB
SHA256 83f3facda6d1cbd8b3cade0f8c1356d750b35967404d2a85f82c871206b8f989
MD5 fb5048963b0217c6bed6554265812ef3
SHA1 2cdc20445a35f702382d4475ae97d88409a3823d
SHA512 17de7f0c0dbcb717dcb853cda4cb12b7fe7f610af117c9f51c3f4b649e24f1b195cb6f7cb19dab0ad6a8becb32fff2265a87175e35f90d0c18c5305a0a06e699
SSDEEP 49152:w/OJDA5IvNPbNGEADt7i+/yTukuFGNLrkBirx:EOplbchrSiGdkBirx
TLSH
T1CD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6095.tmp

Path C:\Users\Admin\AppData\Local\Temp\6095.tmp
Size 3.6MB
SHA256 efeb33e16c2b999569022e702fc7ab50d000f0f4e6daeb67ddaf2d4169a53976
MD5 dedc5fbe57fc614a156578c0fc16a9e4
SHA1 897472447aed5eed466976263164abb28700c81d
SHA512 df5eb5fa9e891127902113c2614d10b39657033e93b5c6085874e1e281499d0387d177da4498a6d180f16dfb1573cfe7de77db377bbe96549519305440ce5873
SSDEEP 49152:w/OJDSmMDZZNGEADt7i+/yTukuFGNLrkBirx:EO0mEZchrSiGdkBirx
TLSH
T1A306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\64CB.tmp
Size 3.6MB
SHA256 457ef54a3efd5f3abe860ed4bccf508f461770a4ebc47d8edfe0b8fab0f113b9
MD5 3f34d37fab5e7b0ec1771a98230c357e
SHA1 751bc2c3455d8f2410527f54e369f69bb35cdd5f
SHA512 fdb02efa9bbfee53dde2a3e0361893858ca2ef3f9339d52cbf7ac69f68684a97117ae1e9d92003350996cb0950944fcdf9e569a1ba29268f43b701c22ab6e331
SSDEEP 49152:w/OJDd8O9NGEADt7i+/yTukuFGNLrkBirx:EOr8cchrSiGdkBirx
TLSH
T1E406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\65E4.tmp
Size 3.6MB
SHA256 42d77dfb3cfa8bc5c6efdc91757f12608e7a1f015021b74d01090b3b7df0c5b1
MD5 7b7f0092cca51b8feda6a630a45cf6dc
SHA1 449621189f5bfbb88f1e4eb66fc1ea57f8fe3fa7
SHA512 2b0218a7bd5fb67f46cf17ad69c1cccff45ec22c1a6f74f6c9917cfb8d4861f4d2010c39f963c3c2d26511a40869db588c0cb25c2efda0ca7658bbf73003bfa7
SSDEEP 49152:w/OJD/giNGEADt7i+/yTukuFGNLrkBirx:EOt3chrSiGdkBirx
TLSH
T10E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B14.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B14.tmp
Size 3.6MB
SHA256 05cb7f347544563f74749f09b87ed7c19d39d58cbf65db765b8ba198a236b6b0
MD5 feb4582f2fb9de8d83a51fe2d85c6b9a
SHA1 2ea8df088ebc7e9f0093123e0984056855a1578c
SHA512 a8ff107f9c10da2ee3901fa18b0c3ef11957088aca3581e051b559d454c93ada864f78e09a233e80140d648a29cc0c625a88bae45528dd89d44e1cc066feec8d
SSDEEP 49152:w/OJDvBNGEADt7i+/yTukuFGNLrkBirx:EO/chrSiGdkBirx
TLSH
T17C06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6E50.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E50.tmp
Size 3.6MB
SHA256 09f8f7482e04ab2b4c97930c5f6fef37565146cf064fd94e1400ad4436bb8596
MD5 9ff4453fc848602943aefbe8a9fbd682
SHA1 818d2506d888e993dad5111908576455a5dd2a52
SHA512 26eea52672f1e212679bb5b39155a63ac63114360173231795f4f16ca4285d771c15eb003d8c553e8e932e81c5624f67dba9f0a76efbcdf143ebd24da959e8d9
SSDEEP 49152:w/OJD3A7IhRSNGEADt7i+/yTukuFGNLrkBirx:EOlA7I3SchrSiGdkBirx
TLSH
T1B606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\71BB.tmp
Size 3.6MB
SHA256 a2803078fce18d1165b4ebd975bd723c3b50d06cef40c12a02b061a5bf178899
MD5 5c4ca46dfaa9d9eaf48d738a3ec59bcf
SHA1 2b3d9033bbf5efecb93f56aa77415db154ede63f
SHA512 62a9a372524675b85ab9bcc1d77d4868e09d97fec6a0cac5ada60837acd7351743e82ea2c7f162e47e4cd42645608da0af564211638e0b89dd3278f462e248b8
SSDEEP 49152:w/OJDxxpNGEADt7i+/yTukuFGNLrkBirx:EOPfchrSiGdkBirx
TLSH
T1F906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\74F7.tmp
Size 3.6MB
SHA256 25ae1a107fcfbce82005fd8ca4a46596e97f69b80abfbd7019320975d98e91b2
MD5 267d96edd1defd0dca01a24a6142f125
SHA1 39cb9419dda6b0dc9e0bd26b6b44027ae707c22d
SHA512 1faf0e73df65d59e7718aadd701944d84b23f923a9184033cfac6644caac835c648e17035ce3950f3311b8b8ec400cb12e506bc32e35acb9580b82583d552dfd
SSDEEP 49152:w/OJDN7jio5NGEADt7i+/yTukuFGNLrkBirx:EOffn5chrSiGdkBirx
TLSH
T1DC06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7834.tmp

Path C:\Users\Admin\AppData\Local\Temp\7834.tmp
Size 3.6MB
SHA256 8ba0ad1db16c3fdeaf599710e746b295b0bdc2d9bbf3f92abb4b535f27e8696e
MD5 557c70e4828745ad085af1aaaac94d4c
SHA1 0a2e4f5d53fdb39d57f3e9e810044c9130f3651f
SHA512 7ca71611f53ca058c194b6026bd25d76a332996ba5a1c37bcc6f5ae31094d2a39aa90aa24e85fa685b6dbdef2fb1768fff92930c8b115dc5c7cf55369fe33df9
SSDEEP 49152:w/OJDkEJ8JTJheNGEADt7i+/yTukuFGNLrkBirx:EOYhJochrSiGdkBirx
TLSH
T1EF06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A37.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A37.tmp
Size 3.6MB
SHA256 5c2891015d748a9bcffc98e35391f3eb539da800b4b8ef42f5fea8ba9c46d741
MD5 1788cb72ec90cb2b850b7f6f720a3d8c
SHA1 5e0c0b40d58e68d5ea02ea4ea9469394c550b0d2
SHA512 f4b778bf1c5f5043e08bfd3811ff96bd1453f20fe90da26750f9fe0daeef1094360a3b59eda099ad728b2806d00f2d92c3648fea828b8350d5ceb971775eb928
SSDEEP 49152:w/OJDW77WiNGEADt7i+/yTukuFGNLrkBirx:EOU7FchrSiGdkBirx
TLSH
T1B006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E7D.tmp
Size 3.6MB
SHA256 7c44717bd8c5c7e684e645ae339f176b07351671c8a9e8720143ceacd49293fb
MD5 52966d847599dabde50c42d05fe7d4aa
SHA1 3b391a9c6ca7fcda13e1ed2606e527d148f2272d
SHA512 388d0864442f63829f9e9fdf690ad2dd382e56df2bd442b852707f487ff5be1c4cf80d9cbb212a9e8dd6b7a849afd403c6e3d7b65b1ad327c3f35f53c03f636a
SSDEEP 49152:w/OJD5hepZnCvZNNGEADt7i+/yTukuFGNLrkBirx:EOX6nENchrSiGdkBirx
TLSH
T1FF06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

811D.tmp

Path C:\Users\Admin\AppData\Local\Temp\811D.tmp
Size 3.6MB
SHA256 73f06eaf2d2c52e1683c8083f457bf998e07543e3ea77172f6c9f53a51a6392c
MD5 cf7e5c02b1049844cca63c46b3c5844b
SHA1 7a3c401930ab588be5fc2ef04a8777a13288464a
SHA512 a98c700bab3434977a650d918820afc2013ac1cb77c767456c8b11538c73e7ef7326369961bf7669221da97c50203b8f11c6b0707f5734a9f03da63d160e0042
SSDEEP 49152:w/OJD69EDwNGEADt7i+/yTukuFGNLrkBirx:EOIEDwchrSiGdkBirx
TLSH
T1FD06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\82D2.tmp
Size 3.6MB
SHA256 0b19ace2ce2f7c3e1756ec41f95cf65eda734cb99fef3298066714665f78f2fd
MD5 e731b83ea29db8da9a06b7dc36b8a75e
SHA1 b4adea6a9d03792cd3eaafcce4133325328202b7
SHA512 f8d9eff3dba75f765edba513f5c29f54a1bd605babdbaafe6f99de3b0d1ae084eef499f91df0d42bc5b73201b7becf889b526b4af191434894fe3460e9b245f7
SSDEEP 49152:w/OJD+ftpNGEADt7i+/yTukuFGNLrkBirx:EOMfXchrSiGdkBirx
TLSH
T12C06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\83DC.tmp
Size 3.6MB
SHA256 bbab1e19a52b1404802bd5ce50087f42f2e270fbdabae67f47dc2947942d4a62
MD5 b758fdce61acdb2c03a0a0b4f31e60cf
SHA1 cfa033c725a60714584013b925787cc028f265bf
SHA512 89ebb5c9d50ad2bca28d45be9663e602ee036a07c2ca8b7e29dc89b1e3ec1f220c7fc9abf98bd314cbf9ddc95cccd4166338714c6b76e04dc5493c17c16e7466
SSDEEP 49152:w/OJD5N0Kh0lpbjNGEADt7i+/yTukuFGNLrkBirx:EOvN0FchrSiGdkBirx
TLSH
T19B06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8514.tmp

Path C:\Users\Admin\AppData\Local\Temp\8514.tmp
Size 3.6MB
SHA256 27dbab2454b9a3a1862979d9f4fe9e1b7365ec5d958d7d78511ad34493c1a77d
MD5 0d8b93c45c99263c28d4a2f72d9c0a74
SHA1 be74f2812f43118f8f81b9b97ddfef882b09e46e
SHA512 5b37e2f6b95412d177c3ef40c8de517c5df3c66d7a33cf15b43a3f5dbdf5786a159b56571e160c447f9c3568bcf0b1f2e87cd28619b0c6f99d8672c3ea5d058b
SSDEEP 49152:w/OJD7ojrF+T3NGEADt7i+/yTukuFGNLrkBirx:EOpoychrSiGdkBirx
TLSH
T1BB06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

862E.tmp

Path C:\Users\Admin\AppData\Local\Temp\862E.tmp
Size 3.6MB
SHA256 13a620b9231b8eae8aaf7d3b438280179b0fe176ea0e4e92779af593be1103e4
MD5 ffe5dda2260411bf27c6a574262e700a
SHA1 eb8dc6be0f7c9e37452e18fb1a3110ab75ab159f
SHA512 209d2edfe29d4b7e381fef62d8405230821993b91168dd0b9257daac4b1eaf6232b254c3f934cad1a55b49398b31e291b8f2ba2a1757fb2cc9ab8c51b59de9dc
SSDEEP 49152:w/OJDoxddtv7iNGEADt7i+/yTukuFGNLrkBirx:EOmVRuchrSiGdkBirx
TLSH
T13406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8737.tmp

Path C:\Users\Admin\AppData\Local\Temp\8737.tmp
Size 3.6MB
SHA256 1b12df663600b92e0bf3fb7ace6c338c86bcfe208dd77d7f34d31142de6c7a0c
MD5 d6d4debd183af17e462ec9d4d53a3338
SHA1 becd3752f956f733993f79b70d7192ffec022912
SHA512 c2185476e03d09634ce2ba743ec1c8880c31de3565cb898d6443e54802f5eaace72d39e1a43c97b11ae2b330b5758f7b53480c67b2da9771f9f74770494262b4
SSDEEP 49152:w/OJDs5+pnNGEADt7i+/yTukuFGNLrkBirx:EOtpnchrSiGdkBirx
TLSH
T1D806831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8822.tmp

Path C:\Users\Admin\AppData\Local\Temp\8822.tmp
Size 3.6MB
SHA256 949f9ab3c19f6aba3d85adc0fa14728b85d314e80b6cccd11d7e84333c80a713
MD5 ca21138beb1e0f049edb81e1b4f2f63e
SHA1 1b5362621cffca51789cbfab493d1a9203cdee6a
SHA512 e5b09cdbbe3dda8ed73557b5f648ed6292f1b2a22129183115b8eaa84277fc06e6ca4b0620c7d99a33a66f83824c95901b6c3514ba87c7fd9358b563aa311a93
SSDEEP 49152:w/OJDK+XWNGEADt7i+/yTukuFGNLrkBirx:EOvWchrSiGdkBirx
TLSH
T1CF06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\88FC.tmp
Size 3.6MB
SHA256 303ece5094154b1c6d75d7ffbfd2641d6c637d9c8f14630722d8e7da0ed7f752
MD5 fab04fbc4db26cf529a89df50059f109
SHA1 35fa037455976da8e14a6f845e1a7c106259c4c9
SHA512 c15398fa3f2542cb2412219e1a509162f6161d15bef389edf682d4cc91fb5639fad863f3fc040fdfea72eb6da7528baab399cfaa92d1fff8fef1336025428533
SSDEEP 49152:w/OJD1Nj1QsDNGEADt7i+/yTukuFGNLrkBirx:EOF1XchrSiGdkBirx
TLSH
T1E106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\89E7.tmp
Size 3.6MB
SHA256 5caf3150f2ce672de728f905126da1cdd2192e96abb17f3c981de01f50520d86
MD5 9f3a7224895d2838373cac66effecbdd
SHA1 dbb2317449604026e10c38b574ea95c62e1a1927
SHA512 840a29c5d3bb464a82c294306809b977bc05ef7dc15c5f3bdcf1dc4d008592b9f73e210fe2188435abf492eb194e2443ba73a443e73b1b87dd9bb93a9a0b6407
SSDEEP 49152:w/OJDKVNgNGEADt7i+/yTukuFGNLrkBirx:EOYVNgchrSiGdkBirx
TLSH
T1CC06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8AC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\8AC2.tmp
Size 3.6MB
SHA256 18a3c406950d8b3aeccae7f4996f08406a201576100d460e5237216511ac85fd
MD5 0d671e15a673b473238a81e7ea3026d9
SHA1 4ea321858723cb756c70e365b8660a4abfbaf5ae
SHA512 4ae80cb89d53627fb0820f3853818ccc1ed265f2109263bc532cf0f968125e8d013e39b53e308c985a5699b09d389c5d98caae0a6940362f683eb7ee15199364
SSDEEP 49152:w/OJDAE6gNGEADt7i+/yTukuFGNLrkBirx:EOGPgchrSiGdkBirx
TLSH
T1CD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B7D.tmp
Size 3.6MB
SHA256 ff9a483e4882ca94a7c6980a7330c36e2e5f10ce1e19ae49f683758aa6b66222
MD5 a2778546735af2fd301b42045d90ac92
SHA1 e187ac28de910624193f4bda60dcdc42ae69a7d4
SHA512 9258b0cca424677c55ea607d42ab6ce48f05f2d9723c8dc1468042080cd771e773d6e16e74a688653f03313cc90c0eac773ddacbbaa49d87c546fd0f52f41d2c
SSDEEP 49152:w/OJDZ0hZGNGEADt7i+/yTukuFGNLrkBirx:EO24chrSiGdkBirx
TLSH
T17E06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8C39.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C39.tmp
Size 3.6MB
SHA256 bbed33edbfd7be54e87365427a2841181eaecc48545341ff19ca33bb99db60a4
MD5 c6383f8782146c82c5216740444656b9
SHA1 55852f2e093e61969a3120956d91827b4793cd82
SHA512 d078d9e89e312c5cca5e669740c22234aecbbb024489f7a00d4f57481f62953a35cf511e028b831367fa466d97f12d32cc35d630db1ae3786019e0a47ac6af3c
SSDEEP 49152:w/OJDfJTUe7LSrNGEADt7i+/yTukuFGNLrkBirx:EOjUrchrSiGdkBirx
TLSH
T1C406831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8D13.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D13.tmp
Size 3.6MB
SHA256 b3ad295c010a35f1ae7e562e75907b5516884f217fe35eda59f1f177d1a07eea
MD5 4a8024a60cd942ba83e5d9644be06bcd
SHA1 4e90239926cd4b35d72d38230c2b93046e09f956
SHA512 aba81dfc13e23310b13721b82466bcec34671aa6799c686ddccbd7197fb86fae6bdf2d623e6e35c039b3d1ca385b074c5342a9db1159c0f85f8e4e2587384847
SSDEEP 49152:w/OJD0YQdhdVNNGEADt7i+/yTukuFGNLrkBirx:EOyr7zNchrSiGdkBirx
TLSH
T11306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\8DEE.tmp
Size 3.6MB
SHA256 434ed0b7137f7e1e01804835b5e8d878c155018ec2820ccfe15b05d2f865a3ec
MD5 3ac8ef7f73fd0ecaef25be2290463b2e
SHA1 1732f7cea4cd9560c98bcfdd2aa657a5de85dc53
SHA512 6f3de080a4594cb6b57e20ae16c40b7d6b197e937f22ed8c9036e3941cc44edcdcf40e0855f8999a77405b23c5ad04d92a20c93b9c82fb066660658b33f2956a
SSDEEP 49152:w/OJDw3TNGEADt7i+/yTukuFGNLrkBirx:EOO3TchrSiGdkBirx
TLSH
T13006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\8EAA.tmp
Size 3.6MB
SHA256 ea74e977104d85567e9ec857fb01ec37f4b45e111d057957b0d3b9c0833c33f4
MD5 fa8cb3909a8588b00d7ba5546a991b0f
SHA1 c054ea55e70e4e8a60c5f056dad7bc8d55b157c8
SHA512 8efaec83d1eeb00703c904c3e9402c5666ea6931626d0322ce4e8c4b91b14423b659300d696d9961663219b3867a5b5b503e55ac4f73a57176e0c077867d5883
SSDEEP 49152:w/OJD2Cn5yNGEADt7i+/yTukuFGNLrkBirx:EOdychrSiGdkBirx
TLSH
T1EE06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8F84.tmp

Path C:\Users\Admin\AppData\Local\Temp\8F84.tmp
Size 3.6MB
SHA256 b10b72152012f4882826ee1b51e194e9d9462628cdc768ebac9cc99e7ae4ce1c
MD5 363b49a28f4a6017eb30c079cae131be
SHA1 a8371cb4e77c00ea907f1b1069bd95ef6cad6159
SHA512 5ac87ead7ce44e6111f81feb9cfea6cd6cf1418c36ea0efd95e3979092292fba2a7c2d3b016a796f97be291f4c517b838b65e7e436314ec672036c0c7381d314
SSDEEP 49152:w/OJDRpFwUAn7DNGEADt7i+/yTukuFGNLrkBirx:EOnmchrSiGdkBirx
TLSH
T1AA06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9030.tmp

Path C:\Users\Admin\AppData\Local\Temp\9030.tmp
Size 3.6MB
SHA256 7d066f5591500802e7f34e4ee8ab22edd3c7d06dd4dbe0df2bd6965eb1d6d1ed
MD5 68ddfeaf7b5cc2c446228bdb6430e480
SHA1 1d216eb4bfb77b4a628a8006321be699c21cbbb5
SHA512 716e745ae81913b1bc705a8f6a671a5628128522058883388d3a5562a49866ff606f7079f1cae77b1492c01fa273fe24d48bde99e59c563964365405e0a958df
SSDEEP 49152:w/OJD6SGKNGEADt7i+/yTukuFGNLrkBirx:EOXchrSiGdkBirx
TLSH
T1F506831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\90CC.tmp
Size 3.6MB
SHA256 880308d93c5b95bdbe0943e3d8eabb74449e7091afa168dd9044a3c88c25292f
MD5 3b2a4a2862e6ce5bb8b291817cd9125c
SHA1 5f756f092337349f819e5df1081a02c07bfa23d5
SHA512 a4653d79abaafdc49f5ad0195ad67a86f2e10898c36fe6be4445383f9ca560457fb6df2b09c35b3c2034a9d842da465bc527d79bf9bc777d3c1571f8e0032eab
SSDEEP 49152:w/OJDOCJvM4NGEADt7i+/yTukuFGNLrkBirx:EOgC24chrSiGdkBirx
TLSH
T1D206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9169.tmp

Path C:\Users\Admin\AppData\Local\Temp\9169.tmp
Size 3.6MB
SHA256 ffc7eb892c5b87115b32e2153087c0522671e1bf5eeec8e23463504185614ff7
MD5 8092e37b6870b64a79ad732c52ac2b6c
SHA1 1140480951b8caff9542222565339807a80c6231
SHA512 1f41df063bb8a199615e6143bc181118f59cd12013b4ce41ae00ce9879ccb2a9ce6a2a92af59cbf959ccea5779f9983a53de182ea44785aef343bfc9dfa072fd
SSDEEP 49152:w/OJDJGMNGEADt7i+/yTukuFGNLrkBirx:EOD3chrSiGdkBirx
TLSH
T1A106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9234.tmp

Path C:\Users\Admin\AppData\Local\Temp\9234.tmp
Size 3.6MB
SHA256 a293be831ac7b5003768cbc844f6f9f28e88299dcc7ef70ef67d15151227180f
MD5 488deb39f2906efd2f01a96a40175488
SHA1 0286c99f0906ff2b0c7ec0ef0232aa3f7895005e
SHA512 b62720e3c600b0b6f6a3b55f2dcd246dc0d3dcd5fd6e6613d6ca436f0319f3a57dd1afe0df84bfeef4c3e54e79b25b13487acfd90b38b1e0297197ee0920cd30
SSDEEP 49152:w/OJD7MaNGEADt7i+/yTukuFGNLrkBirx:EO1TchrSiGdkBirx
TLSH
T17706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\92E0.tmp
Size 3.6MB
SHA256 7884e33d34c5b989cde610c730492de30a82258bf89df9597d28168488f69fba
MD5 3dd76db43218267be4eb80a8ceb7f9f3
SHA1 1033bc224afac7f553e785a84a0f92900700a3d7
SHA512 d217bb7806872335b0fba8a998c51b2b53923345d58d301ef77067f856aba47e5491b11a3961d5a45a66b5626cac7f615eddc3a92e25a992e70dbd0269a1e083
SSDEEP 49152:w/OJD551jJIV/aNGEADt7i+/yTukuFGNLrkBirx:EOfjJWachrSiGdkBirx
TLSH
T13706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-118-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/1100-111-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/1160-146-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1160-153-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1196-40-0x00000000003C0000-0x0000000000443000-memory.dmp

Download

memory/1196-49-0x00000000003C0000-0x0000000000443000-memory.dmp

Download

memory/1236-117-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/1236-125-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/1376-294-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/1376-288-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/1512-104-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/1512-110-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/1812-239-0x0000000000230000-0x00000000002B3000-memory.dmp

Download

memory/1812-233-0x0000000000230000-0x00000000002B3000-memory.dmp

Download

memory/1824-228-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/1824-222-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/2036-70-0x0000000000920000-0x00000000009A3000-memory.dmp

Download

memory/2036-61-0x0000000000920000-0x00000000009A3000-memory.dmp

Download

memory/2188-269-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/2188-263-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/2408-154-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/2408-160-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/2420-279-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/2420-273-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/2428-166-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

memory/2428-174-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

memory/2580-138-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/2580-145-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/2736-5-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/2736-14-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/2816-96-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/2816-105-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/3020-188-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/3020-180-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/3388-224-0x0000000000390000-0x0000000000413000-memory.dmp

Download

memory/3388-215-0x0000000000390000-0x0000000000413000-memory.dmp

Download

memory/3552-173-0x0000000000340000-0x00000000003C3000-memory.dmp

Download

memory/3552-182-0x0000000000340000-0x00000000003C3000-memory.dmp

Download

memory/3628-248-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/3628-254-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/3684-249-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/3684-244-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/3788-289-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/3788-283-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/3900-124-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/3900-131-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/3960-258-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3960-264-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/4128-298-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/4128-303-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/4188-89-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/4188-98-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/4224-26-0x0000000000FA0000-0x0000000001023000-memory.dmp

Download

memory/4224-34-0x0000000000FA0000-0x0000000001023000-memory.dmp

Download

memory/4280-12-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/4280-21-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/4496-243-0x0000000000990000-0x0000000000A13000-memory.dmp

Download

memory/4496-238-0x0000000000990000-0x0000000000A13000-memory.dmp

Download

memory/4500-268-0x0000000000DB0000-0x0000000000E33000-memory.dmp

Download

memory/4500-274-0x0000000000DB0000-0x0000000000E33000-memory.dmp

Download

memory/4536-75-0x0000000000B40000-0x0000000000BC3000-memory.dmp

Download

memory/4536-82-0x0000000000B40000-0x0000000000BC3000-memory.dmp

Download

memory/4592-253-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/4592-259-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/4604-55-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/4604-47-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/4656-217-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/4656-208-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/4880-168-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4880-159-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4996-210-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/4996-201-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/5104-76-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/5104-68-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/5212-35-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/5212-41-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/5260-187-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/5260-195-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/5356-54-0x0000000000E50000-0x0000000000ED3000-memory.dmp

Download

memory/5356-63-0x0000000000E50000-0x0000000000ED3000-memory.dmp

Download

memory/5372-203-0x0000000000260000-0x00000000002E3000-memory.dmp

Download

memory/5372-194-0x0000000000260000-0x00000000002E3000-memory.dmp

Download

memory/5488-299-0x00000000003A0000-0x0000000000423000-memory.dmp

Download

memory/5488-293-0x00000000003A0000-0x0000000000423000-memory.dmp

Download

memory/5516-234-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/5516-229-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/5836-7-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/5836-0-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/5940-83-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/5940-90-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/5948-139-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/5948-132-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/6048-19-0x0000000000D00000-0x0000000000D83000-memory.dmp

Download

memory/6048-28-0x0000000000D00000-0x0000000000D83000-memory.dmp

Download

memory/6068-284-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/6068-278-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads