80ea6a3a418b9eb676ef551bbb6fbf7b1c14656b827b66ad458fd20ac7f38318

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_1b289eee2497fe69a9733d036f34b7b9_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260730-cgbsssxcnd
SHA256 80ea6a3a418b9eb676ef551bbb6fbf7b1c14656b827b66ad458fd20ac7f38318
MD5 1b289eee2497fe69a9733d036f34b7b9
SHA1 39e25fd1a1e3eacb70bf004960e81004cf1b04f0
SHA512 ca439f2db7a9d7fd44071b3c856e79c94829c5eebbb5da7ea524e45649ca2c9c277f9cf1ae2f5346a269ccff95149c70689af3579b5a8e2ebefc4ec1c61e247e
SSDEEP 49152:w/OJDaY8zbXLLNGEADt7i+/yTukuFGNLrkBirx:EOA5znchrSiGdkBirx
TLSH
T18C06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4348	2820.tmp
1064	29D5.tmp
4844	2EE6.tmp
6120	2FE0.tmp
5504	3399.tmp
4216	36A6.tmp
1476	37FE.tmp
2556	3C34.tmp
4560	3F22.tmp
4360	42BC.tmp
4900	4404.tmp
3368	47BD.tmp
1132	4A6D.tmp
236	4D2C.tmp
5468	4FFB.tmp
2552	52D9.tmp
2400	5579.tmp
5872	5838.tmp
3680	5AA9.tmp
5760	5D68.tmp
1176	5E91.tmp
4688	6373.tmp
5036	6680.tmp
3400	6930.tmp
3192	6BDF.tmp
4412	6E9E.tmp
2536	715E.tmp
3780	73DE.tmp
2160	74F7.tmp
1136	792E.tmp
5500	7BAE.tmp
864	7E5E.tmp
5548	80BF.tmp
3892	81A9.tmp
3920	8255.tmp
2664	8311.tmp
4448	83EC.tmp
4680	84E6.tmp
2404	85EF.tmp
1144	8718.tmp
812	8812.tmp
5136	890C.tmp
5972	89F6.tmp
1932	8B10.tmp
5880	8BDB.tmp
5716	8CF4.tmp
5644	8DEE.tmp
3836	8F07.tmp
1564	904F.tmp
540	912A.tmp
6036	91D6.tmp
868	9292.tmp
1724	935D.tmp
3084	9447.tmp
3372	9522.tmp
1100	95ED.tmp
820	96F7.tmp
4416	97C2.tmp
5804	989C.tmp
5860	9958.tmp
4664	9A42.tmp
3972	9AFE.tmp
5784	9BD9.tmp
3168	9CA4.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6BFA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32F3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B28D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC19.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	280B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC55.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BAE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8311.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9E69.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74B4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EEC6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	369D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8BDB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDD8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C097.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19A4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C390.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AB4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EBB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B57B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B6F2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D3A2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E18.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A53A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44E5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49A8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F776.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B0D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	109B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A440.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8E4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC48.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F7D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C162.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EA66.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A42.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56CC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F4B2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA8A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E8F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50D1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B4E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95ED.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F07C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C53A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35E6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9F20.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A9B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EB2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	198F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B26.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ADC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BB81.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C4C8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9AFE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E0F0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	377C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D2D7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4348	2236	2026-07-29_1b289eee2497fe69a9733d036f34b7b9_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4348 wrote to memory of 1064	4348	2820.tmp	90
PID 1064 wrote to memory of 4844	1064	29D5.tmp	91
PID 4844 wrote to memory of 6120	4844	2EE6.tmp	92
PID 6120 wrote to memory of 5504	6120	2FE0.tmp	93
PID 5504 wrote to memory of 4216	5504	3399.tmp	94
PID 4216 wrote to memory of 1476	4216	36A6.tmp	95
PID 1476 wrote to memory of 2556	1476	37FE.tmp	96
PID 2556 wrote to memory of 4560	2556	3C34.tmp	97
PID 4560 wrote to memory of 4360	4560	3F22.tmp	98
PID 4360 wrote to memory of 4900	4360	42BC.tmp	99
PID 4900 wrote to memory of 3368	4900	4404.tmp	100
PID 3368 wrote to memory of 1132	3368	47BD.tmp	101
PID 1132 wrote to memory of 236	1132	4A6D.tmp	102
PID 236 wrote to memory of 5468	236	4D2C.tmp	103
PID 5468 wrote to memory of 2552	5468	4FFB.tmp	104
PID 2552 wrote to memory of 2400	2552	52D9.tmp	105
PID 2400 wrote to memory of 5872	2400	5579.tmp	106
PID 5872 wrote to memory of 3680	5872	5838.tmp	107
PID 3680 wrote to memory of 5760	3680	5AA9.tmp	108
PID 5760 wrote to memory of 1176	5760	5D68.tmp	109
PID 1176 wrote to memory of 4688	1176	5E91.tmp	110
PID 4688 wrote to memory of 5036	4688	6373.tmp	111
PID 5036 wrote to memory of 3400	5036	6680.tmp	112
PID 3400 wrote to memory of 3192	3400	6930.tmp	113
PID 3192 wrote to memory of 4412	3192	6BDF.tmp	114
PID 4412 wrote to memory of 2536	4412	6E9E.tmp	115
PID 2536 wrote to memory of 3780	2536	715E.tmp	116
PID 3780 wrote to memory of 2160	3780	73DE.tmp	117
PID 2160 wrote to memory of 1136	2160	74F7.tmp	118
PID 1136 wrote to memory of 5500	1136	792E.tmp	119
PID 5500 wrote to memory of 864	5500	7BAE.tmp	120
PID 864 wrote to memory of 5548	864	7E5E.tmp	121
PID 5548 wrote to memory of 3892	5548	80BF.tmp	122
PID 3892 wrote to memory of 3920	3892	81A9.tmp	123
PID 3920 wrote to memory of 2664	3920	8255.tmp	124
PID 2664 wrote to memory of 4448	2664	8311.tmp	125
PID 4448 wrote to memory of 4680	4448	83EC.tmp	126
PID 4680 wrote to memory of 2404	4680	84E6.tmp	127
PID 2404 wrote to memory of 1144	2404	85EF.tmp	128
PID 1144 wrote to memory of 812	1144	8718.tmp	129
PID 812 wrote to memory of 5136	812	8812.tmp	130
PID 5136 wrote to memory of 5972	5136	890C.tmp	131
PID 5972 wrote to memory of 1932	5972	89F6.tmp	132
PID 1932 wrote to memory of 5880	1932	8B10.tmp	133
PID 5880 wrote to memory of 5716	5880	8BDB.tmp	134
PID 5716 wrote to memory of 5644	5716	8CF4.tmp	135
PID 5644 wrote to memory of 3836	5644	8DEE.tmp	136
PID 3836 wrote to memory of 1564	3836	8F07.tmp	137
PID 1564 wrote to memory of 540	1564	904F.tmp	138
PID 540 wrote to memory of 6036	540	912A.tmp	139
PID 6036 wrote to memory of 868	6036	91D6.tmp	140
PID 868 wrote to memory of 1724	868	9292.tmp	141
PID 1724 wrote to memory of 3084	1724	935D.tmp	142
PID 3084 wrote to memory of 3372	3084	9447.tmp	143
PID 3372 wrote to memory of 1100	3372	9522.tmp	144
PID 1100 wrote to memory of 820	1100	95ED.tmp	145
PID 820 wrote to memory of 4416	820	96F7.tmp	146
PID 4416 wrote to memory of 5804	4416	97C2.tmp	147
PID 5804 wrote to memory of 5860	5804	989C.tmp	148
PID 5860 wrote to memory of 4664	5860	9958.tmp	149
PID 4664 wrote to memory of 3972	4664	9A42.tmp	150
PID 3972 wrote to memory of 5784	3972	9AFE.tmp	152
PID 5784 wrote to memory of 3168	5784	9BD9.tmp	153

C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b289eee2497fe69a9733d036f34b7b9_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_1b289eee2497fe69a9733d036f34b7b9_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\2820.tmp
  "C:\Users\Admin\AppData\Local\Temp\2820.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\29D5.tmp
    "C:\Users\Admin\AppData\Local\Temp\29D5.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
      "C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\2FE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\3399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3399.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\36A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36A6.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\37FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37FE.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\3C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C34.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\3F22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F22.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\42BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42BC.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\4404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4404.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\47BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47BD.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\4A6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\4D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\4FFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\52D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D9.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\5579.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5579.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\5838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5838.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\5AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\5D68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D68.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\5E91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E91.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\6373.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6373.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\6680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6680.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\6930.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6930.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\6BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\6E9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\715E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\715E.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\73DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73DE.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\74F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74F7.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\792E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\792E.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\7BAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\7E5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\80BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80BF.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\81A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81A9.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\8255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8255.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\8311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8311.tmp"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\83EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83EC.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\84E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84E6.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\85EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85EF.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\8718.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8718.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\8812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8812.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\890C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\890C.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\89F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89F6.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\8B10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B10.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\8BDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\8CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\8DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\8F07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F07.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\904F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\904F.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\912A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\912A.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\91D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91D6.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\9292.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9292.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\935D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\935D.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\9447.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9447.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\9522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9522.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\95ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95ED.tmp"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\96F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96F7.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\97C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97C2.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\989C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\989C.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\9958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9958.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\9A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A42.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\9AFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\9BD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\9CA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"
        65⤵
        Executes dropped EXE
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\9D7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"
        66⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\9E69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E69.tmp"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\9F34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F34.tmp"
        68⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\9FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"
        69⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\A0BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"
        70⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\A195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A195.tmp"
        71⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\A270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A270.tmp"
        72⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\A33B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A33B.tmp"
        73⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\A406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A406.tmp"
        74⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\A4C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"
        75⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\A5AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"
        76⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\A658.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A658.tmp"
        77⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\A733.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A733.tmp"
        78⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\A7FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"
        79⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\A8B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\A965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A965.tmp"
        81⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\AA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA30.tmp"
        82⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\AAEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"
        83⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\ABA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"
        84⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\AC73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC73.tmp"
        85⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\AD2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"
        86⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\ADF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"
        87⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\AEB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"
        88⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\AF9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"
        89⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\B06A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B06A.tmp"
        90⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\B116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B116.tmp"
        91⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\B1D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"
        92⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\B28D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B28D.tmp"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\B358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B358.tmp"
        94⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\B404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B404.tmp"
        95⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\B4CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"
        96⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\B57B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B57B.tmp"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\B637.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B637.tmp"
        98⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\B6F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\B79E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B79E.tmp"
        100⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\B888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B888.tmp"
        101⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\B934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B934.tmp"
        102⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\BA0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"
        103⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\BABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BABB.tmp"
        104⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\BB96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB96.tmp"
        105⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\BC41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC41.tmp"
        106⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\BCFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"
        107⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\BDD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\BE84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE84.tmp"
        109⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\BF2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"
        110⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\BFDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"
        111⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\C097.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C097.tmp"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\C162.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C162.tmp"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\C21D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C21D.tmp"
        114⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\C2D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"
        115⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\C3A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"
        116⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\C46F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46F.tmp"
        117⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\C53A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C53A.tmp"
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\C615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C615.tmp"
        119⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\C6D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"
        120⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\C79C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C79C.tmp"
        121⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\C838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C838.tmp"
        122⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\C8F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"
        123⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\C9BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"
        124⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\CA8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\CB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB55.tmp"
        126⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\CC01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC01.tmp"
        127⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\CCCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"
        128⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\CD87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD87.tmp"
        129⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\CE24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE24.tmp"
        130⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\CEEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"
        131⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\CF9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"
        132⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\D066.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D066.tmp"
        133⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\D112.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D112.tmp"
        134⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\D1FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"
        135⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\D2D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\D3A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\D48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D48C.tmp"
        138⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\D577.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D577.tmp"
        139⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\D613.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D613.tmp"
        140⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\D6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"
        141⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\D7B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"
        142⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\D884.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D884.tmp"
        143⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\D95F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D95F.tmp"
        144⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\DA1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"
        145⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\DAD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"
        146⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\DB91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB91.tmp"
        147⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\DC5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"
        148⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\DD18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD18.tmp"
        149⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\DDD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"
        150⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\DE8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"
        151⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\DF5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"
        152⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\E035.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E035.tmp"
        153⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\E0F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\E1CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"
        155⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\E286.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E286.tmp"
        156⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\E332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E332.tmp"
        157⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\E3FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"
        158⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\E4D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"
        159⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\E5A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"
        160⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\E68E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E68E.tmp"
        161⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\E759.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E759.tmp"
        162⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\E814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E814.tmp"
        163⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\E8D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"
        164⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\E98B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E98B.tmp"
        165⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\EA66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA66.tmp"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\EB21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB21.tmp"
        167⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\EBFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"
        168⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\ECC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"
        169⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\EDA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"
        170⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\EE8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"
        171⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\EF48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF48.tmp"
        172⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\F013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F013.tmp"
        173⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\F0FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"
        174⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\F1D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"
        175⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\F2C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"
        176⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\F37E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F37E.tmp"
        177⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\F42A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F42A.tmp"
        178⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\F4F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"
        179⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\F5C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"
        180⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\F68B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F68B.tmp"
        181⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\F776.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F776.tmp"
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\F831.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F831.tmp"
        183⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\F8ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"
        184⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\F9A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"
        185⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\FA73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA73.tmp"
        186⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\FB4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"
        187⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\FC19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC19.tmp"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\FCE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"
        189⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\FDDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"
        190⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\FE9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"
        191⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\FF75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF75.tmp"
        192⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20.tmp"
        193⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC.tmp"
        194⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\197.tmp"
        195⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\272.tmp"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\33D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33D.tmp"
        197⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418.tmp"
        198⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\4D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D4.tmp"
        199⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\59F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F.tmp"
        200⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\64B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64B.tmp"
        201⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\716.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\716.tmp"
        202⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800.tmp"
        203⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC.tmp"
        204⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\967.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\967.tmp"
        205⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A42.tmp"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0D.tmp"
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\BE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE8.tmp"
        208⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\CA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA4.tmp"
        209⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\D9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9E.tmp"
        210⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\E3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3A.tmp"
        211⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15.tmp"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEF.tmp"
        213⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\109B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\109B.tmp"
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\1147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1147.tmp"
        215⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\1212.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1212.tmp"
        216⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\12BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12BE.tmp"
        217⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\137A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\137A.tmp"
        218⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\1445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1445.tmp"
        219⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\14F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14F1.tmp"
        220⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\15AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15AC.tmp"
        221⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\1687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1687.tmp"
        222⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\1752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1752.tmp"
        223⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\181D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\181D.tmp"
        224⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\18D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18D9.tmp"
        225⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\19A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19A4.tmp"
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\1A40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A40.tmp"
        227⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\1AFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"
        228⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\1BA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"
        229⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\1C53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C53.tmp"
        230⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\1D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"
        231⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\1DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"
        232⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\1E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E95.tmp"
        233⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\1F51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F51.tmp"
        234⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\200C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\200C.tmp"
        235⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\20B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20B8.tmp"
        236⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\2174.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2174.tmp"
        237⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\222F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\222F.tmp"
        238⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\22EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22EB.tmp"
        239⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\23C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23C5.tmp"
        240⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\2462.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2462.tmp"
        241⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\251D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\251D.tmp"
        242⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\25C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25C9.tmp"
        243⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\2694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2694.tmp"
        244⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\2750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2750.tmp"
        245⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\280B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\280B.tmp"
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\28D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D6.tmp"
        247⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\2982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2982.tmp"
        248⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\2A2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"
        249⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\2ADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"
        250⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\2B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B76.tmp"
        251⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\2C32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C32.tmp"
        252⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\2CED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CED.tmp"
        253⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\2DA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"
        254⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\2E83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E83.tmp"
        255⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\2F2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"
        256⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\300A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\300A.tmp"
        257⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\30A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30A6.tmp"
        258⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\3152.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3152.tmp"
        259⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\323D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\323D.tmp"
        260⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\32F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F8.tmp"
        261⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\33B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33B4.tmp"
        262⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\346F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\346F.tmp"
        263⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\353A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\353A.tmp"
        264⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\35E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35E6.tmp"
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\36D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36D0.tmp"
        266⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\377C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\377C.tmp"
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\3838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3838.tmp"
        268⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\38E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38E4.tmp"
        269⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\3990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3990.tmp"
        270⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\3A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"
        271⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\3B26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B26.tmp"
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\3BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"
        273⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\3C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C8D.tmp"
        274⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\3D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D58.tmp"
        275⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\3E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E14.tmp"
        276⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\3EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"
        277⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\3FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FAA.tmp"
        278⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\4056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4056.tmp"
        279⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\4111.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4111.tmp"
        280⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\41CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41CD.tmp"
        281⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\42A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42A8.tmp"
        282⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\4354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4354.tmp"
        283⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\440F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440F.tmp"
        284⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\44DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44DA.tmp"
        285⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\45A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45A5.tmp"
        286⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\4661.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4661.tmp"
        287⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\472C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\472C.tmp"
        288⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\4836.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4836.tmp"
        289⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\4910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4910.tmp"
        290⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\49BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49BC.tmp"
        291⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\4AB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"
        292⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\4B62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B62.tmp"
        293⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\4C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C3D.tmp"
        294⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\4D08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D08.tmp"
        295⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\4DC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DC3.tmp"
        296⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\4E8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E8F.tmp"
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\4F69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F69.tmp"
        298⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\5025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5025.tmp"
        299⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\50D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50D1.tmp"
        300⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\51AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51AB.tmp"
        301⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\5267.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5267.tmp"
        302⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\5322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5322.tmp"
        303⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\53FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53FD.tmp"
        304⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\54A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54A9.tmp"
        305⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\5565.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5565.tmp"
        306⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\5601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5601.tmp"
        307⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\56CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56CC.tmp"
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\5797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5797.tmp"
        309⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\58B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58B0.tmp"
        310⤵
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\597B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\597B.tmp"
        311⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\5A18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A18.tmp"
        312⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\5AD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"
        313⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\5B8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"
        314⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\5C5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"
        315⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\5D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D44.tmp"
        316⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\5E00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E00.tmp"
        317⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\5EDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EDA.tmp"
        318⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\5FA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FA6.tmp"
        319⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\6071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6071.tmp"
        320⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\612C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\612C.tmp"
        321⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\6207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6207.tmp"
        322⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\62F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62F1.tmp"
        323⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\63AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63AD.tmp"
        324⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\6497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6497.tmp"
        325⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\6553.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6553.tmp"
        326⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\660E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\660E.tmp"
        327⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\66D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66D9.tmp"
        328⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\6785.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6785.tmp"
        329⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\6831.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6831.tmp"
        330⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\68ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68ED.tmp"
        331⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\69C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69C7.tmp"
        332⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\6A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A73.tmp"
        333⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\6B1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B1F.tmp"
        334⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\6BFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BFA.tmp"
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\6CB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"
        336⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\7197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7197.tmp"
        337⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\7253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7253.tmp"
        338⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\732E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\732E.tmp"
        339⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\73E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73E9.tmp"
        340⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\74B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B4.tmp"
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\758F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\758F.tmp"
        342⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\765A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\765A.tmp"
        343⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\7735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7735.tmp"
        344⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\7800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7800.tmp"
        345⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\78CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78CB.tmp"
        346⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\7977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7977.tmp"
        347⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\7A23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A23.tmp"
        348⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\7AEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AEE.tmp"
        349⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\7BA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BA9.tmp"
        350⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\7CA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"
        351⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\7D5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D5F.tmp"
        352⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\7E1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"
        353⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\7EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"
        354⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\7FC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"
        355⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\806C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\806C.tmp"
        356⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\8147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8147.tmp"
        357⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\8202.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8202.tmp"
        358⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\82BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82BE.tmp"
        359⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\8399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8399.tmp"
        360⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\8445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8445.tmp"
        361⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\8500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8500.tmp"
        362⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\85CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85CB.tmp"
        363⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\86C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86C5.tmp"
        364⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\8790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8790.tmp"
        365⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\885B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\885B.tmp"
        366⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\8917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8917.tmp"
        367⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\89F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89F2.tmp"
        368⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\8ADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\8BA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BA7.tmp"
        370⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\8CA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"
        371⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\8D4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"
        372⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\8E18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E18.tmp"
        373⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\8EE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"
        374⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\8FAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FAE.tmp"
        375⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\907A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\907A.tmp"
        376⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\9145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9145.tmp"
        377⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\9200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9200.tmp"
        378⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\92BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92BC.tmp"
        379⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\9396.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9396.tmp"
        380⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\9452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9452.tmp"
        381⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\951D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\951D.tmp"
        382⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\95E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95E8.tmp"
        383⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\96A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96A4.tmp"
        384⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\979E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\979E.tmp"
        385⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\983A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\983A.tmp"
        386⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\9915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9915.tmp"
        387⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\99E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E0.tmp"
        388⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\9A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A9B.tmp"
        389⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\9B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B86.tmp"
        390⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\9C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C51.tmp"
        391⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\9D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"
        392⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\9E06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E06.tmp"
        393⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\9F20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F20.tmp"
        394⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\9FEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"
        395⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\A0A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"
        396⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\A181.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A181.tmp"
        397⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\A26B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A26B.tmp"
        398⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\A356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A356.tmp"
        399⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\A440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A440.tmp"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\A53A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A53A.tmp"
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\A634.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A634.tmp"
        402⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\A73E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A73E.tmp"
        403⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\A809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A809.tmp"
        404⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\A8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8E4.tmp"
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\A9AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"
        406⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\AA89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA89.tmp"
        407⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\AB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB74.tmp"
        408⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\AC6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC6E.tmp"
        409⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\AD49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD49.tmp"
        410⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\AE14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE14.tmp"
        411⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\AF0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"
        412⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\B017.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B017.tmp"
        413⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\B0F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0F2.tmp"
        414⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\B1DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1DC.tmp"
        415⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\B2D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2D6.tmp"
        416⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\B3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3F0.tmp"
        417⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\B4BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4BB.tmp"
        418⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\B5A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5A5.tmp"
        419⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\B690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B690.tmp"
        420⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\B76A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B76A.tmp"
        421⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\B855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B855.tmp"
        422⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\B97E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B97E.tmp"
        423⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\BA87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA87.tmp"
        424⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\BB81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB81.tmp"
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\BC5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC5C.tmp"
        426⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\BD46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD46.tmp"
        427⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\BE40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE40.tmp"
        428⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\BF0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"
        429⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\BFF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFF6.tmp"
        430⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\C0E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E0.tmp"
        431⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\C1CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1CB.tmp"
        432⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\C2C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2C5.tmp"
        433⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\C390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C390.tmp"
        434⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\C4C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4C8.tmp"
        435⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\C593.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C593.tmp"
        436⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\C6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6AD.tmp"
        437⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\C797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C797.tmp"
        438⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\C881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C881.tmp"
        439⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\C99B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C99B.tmp"
        440⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\CA75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA75.tmp"
        441⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\CB7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB7F.tmp"
        442⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\CC89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC89.tmp"
        443⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\CD83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD83.tmp"
        444⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\CE5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE5D.tmp"
        445⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\CF48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF48.tmp"
        446⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\D022.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D022.tmp"
        447⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\D11C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D11C.tmp"
        448⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\D1F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1F7.tmp"
        449⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\D320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D320.tmp"
        450⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\D3EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3EB.tmp"
        451⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\D4D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4D6.tmp"
        452⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\D5A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5A1.tmp"
        453⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\D67B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D67B.tmp"
        454⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\D785.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D785.tmp"
        455⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\D860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D860.tmp"
        456⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\D95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D95A.tmp"
        457⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\DA63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA63.tmp"
        458⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\DB3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB3E.tmp"
        459⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\DC48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC48.tmp"
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\DD03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD03.tmp"
        461⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\DDEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDEE.tmp"
        462⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\DEA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEA9.tmp"
        463⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\DF74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF74.tmp"
        464⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\E05F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E05F.tmp"
        465⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\E12A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E12A.tmp"
        466⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\E1D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1D6.tmp"
        467⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\E2B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2B0.tmp"
        468⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\E37C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E37C.tmp"
        469⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\E466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E466.tmp"
        470⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\E531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E531.tmp"
        471⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\E61B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E61B.tmp"
        472⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\E6E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6E7.tmp"
        473⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\E7C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7C1.tmp"
        474⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\E88C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E88C.tmp"
        475⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\E9B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9B5.tmp"
        476⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\EA61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA61.tmp"
        477⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\EB5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB5B.tmp"
        478⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\EC55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC55.tmp"
        479⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\ED20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED20.tmp"
        480⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\EDCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"
        481⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\EEC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEC6.tmp"
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\EFA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFA1.tmp"
        483⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\F07C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F07C.tmp"
        484⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\F147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F147.tmp"
        485⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\F222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F222.tmp"
        486⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\F2ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2ED.tmp"
        487⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\F3D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3D7.tmp"
        488⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\F4B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4B2.tmp"
        489⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\F5BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5BB.tmp"
        490⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\F677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F677.tmp"
        491⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\F752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F752.tmp"
        492⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\F81D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F81D.tmp"
        493⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\F917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F917.tmp"
        494⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\F9D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9D2.tmp"
        495⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\FADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FADC.tmp"
        496⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\FBB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBB7.tmp"
        497⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\FC91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC91.tmp"
        498⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\FD7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD7C.tmp"
        499⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\FE37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE37.tmp"
        500⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\FF12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF12.tmp"
        501⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\FFBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFBE.tmp"
        502⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89.tmp"
        503⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\164.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\164.tmp"
        504⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\25E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25E.tmp"
        505⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\329.tmp"
        506⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\3E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E4.tmp"
        507⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\4B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B0.tmp"
        508⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\59A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59A.tmp"
        509⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\684.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\684.tmp"
        510⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\76F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76F.tmp"
        511⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\81B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81B.tmp"
        512⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\905.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905.tmp"
        513⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\9E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E0.tmp"
        514⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9B.tmp"
        515⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B86.tmp"
        516⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\C41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C41.tmp"
        517⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\D1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1C.tmp"
        518⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE7.tmp"
        519⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\EB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB2.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\F7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D.tmp"
        521⤵
        System Location Discovery: System Language Discovery
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\1048.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1048.tmp"
        522⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\1113.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1113.tmp"
        523⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\11DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11DF.tmp"
        524⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\12AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12AA.tmp"
        525⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\1356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1356.tmp"
        526⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\1421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1421.tmp"
        527⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\14EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14EC.tmp"
        528⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\15B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15B7.tmp"
        529⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\16A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16A1.tmp"
        530⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\173E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\173E.tmp"
        531⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\1809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1809.tmp"
        532⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\18D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18D4.tmp"
        533⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\198F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\198F.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\1A3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A3B.tmp"
        535⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\1AF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AF7.tmp"
        536⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\1BC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BC2.tmp"
        537⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\1C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C8D.tmp"
        538⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\1D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D58.tmp"
        539⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\1E52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E52.tmp"
        540⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\1F1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F1D.tmp"
        541⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\1FD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FD9.tmp"
        542⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\2094.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2094.tmp"
        543⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\2150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2150.tmp"
        544⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\222A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\222A.tmp"
        545⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\22D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22D6.tmp"
        546⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\23A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23A1.tmp"
        547⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\246D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\246D.tmp"
        548⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\2547.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2547.tmp"
        549⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\2603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2603.tmp"
        550⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\26CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26CE.tmp"
        551⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\2799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2799.tmp"
        552⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\2864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2864.tmp"
        553⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\2920.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2920.tmp"
        554⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\29EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29EB.tmp"
        555⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\2AA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AA6.tmp"
        556⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\2B91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B91.tmp"
        557⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\2C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C3D.tmp"
        558⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\2D08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D08.tmp"
        559⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\2DB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB4.tmp"
        560⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\2E9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E9E.tmp"
        561⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\2F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F79.tmp"
        562⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\3034.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3034.tmp"
        563⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\30E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30E0.tmp"
        564⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\318C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\318C.tmp"
        565⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\3247.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3247.tmp"
        566⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\32F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F3.tmp"
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\33BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33BE.tmp"
        568⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\347A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\347A.tmp"
        569⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\3535.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3535.tmp"
        570⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\35E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35E1.tmp"
        571⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\369D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\369D.tmp"
        572⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\3787.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3787.tmp"
        573⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\3843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3843.tmp"
        574⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\38FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38FE.tmp"
        575⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\39E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39E9.tmp"
        576⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\3AB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AB4.tmp"
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\3B6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B6F.tmp"
        578⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\3C4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C4A.tmp"
        579⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\3D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D25.tmp"
        580⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\3DE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DE0.tmp"
        581⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\3EBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EBB.tmp"
        582⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        583⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\4032.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4032.tmp"
        584⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\40FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40FD.tmp"
        585⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\41F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41F7.tmp"
        586⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\42B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42B3.tmp"
        587⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\435E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\435E.tmp"
        588⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\441A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\441A.tmp"
        589⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\44E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44E5.tmp"
        590⤵
        System Location Discovery: System Language Discovery
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\45B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45B0.tmp"
        591⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\466C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\466C.tmp"
        592⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\4766.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4766.tmp"
        593⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\4812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4812.tmp"
        594⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\490C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\490C.tmp"
        595⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\49A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49A8.tmp"
        596⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\4A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A73.tmp"
        597⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\4B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4E.tmp"
        598⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\4C28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C28.tmp"
        599⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\4CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CF4.tmp"
        600⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\4DAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DAF.tmp"
        601⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\4E4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E4B.tmp"
        602⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\4F26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F26.tmp"
        603⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\4FD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FD2.tmp"
        604⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\508D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\508D.tmp"
        605⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\5139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5139.tmp"
        606⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\5214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5214.tmp"
        607⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\52D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D0.tmp"
        608⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\53AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AA.tmp"
        609⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\5475.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5475.tmp"
        610⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\5531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5531.tmp"
        611⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\561B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\561B.tmp"
        612⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\56D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56D7.tmp"
        613⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\5773.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5773.tmp"
        614⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\585D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\585D.tmp"
        615⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\5909.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5909.tmp"
        616⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\5996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5996.tmp"
        617⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\5AA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA0.tmp"
        618⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\5B6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B6B.tmp"
        619⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\5C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C36.tmp"
        620⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\5CE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CE2.tmp"
        621⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\5D9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D9D.tmp"
        622⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\5E78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E78.tmp"
        623⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\5F24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F24.tmp"
        624⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\5FDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FDF.tmp"
        625⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\608B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\608B.tmp"
        626⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\6166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6166.tmp"
        627⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\6231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6231.tmp"
        628⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\62ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62ED.tmp"
        629⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\63A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63A8.tmp"
        630⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\6473.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6473.tmp"
        631⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\654E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\654E.tmp"
        632⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\6609.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6609.tmp"
        633⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\66D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66D5.tmp"
        634⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\6790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6790.tmp"
        635⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\685B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\685B.tmp"
        636⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\6917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6917.tmp"
        637⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\69E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69E2.tmp"
        638⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\6ABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6ABD.tmp"
        639⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\6BA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BA7.tmp"
        640⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\6C62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C62.tmp"
        641⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\6D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D1E.tmp"
        642⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\6DD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DD9.tmp"
        643⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\6E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E95.tmp"
        644⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\6F60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F60.tmp"
        645⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\703B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\703B.tmp"
        646⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\70F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70F6.tmp"
        647⤵
        
        PID:6368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2820.tmp

Path C:\Users\Admin\AppData\Local\Temp\2820.tmp
Size 3.6MB
SHA256 2eca121c7ce4539475595e5de3104f80df127a98b68485c4bbacc40ac8d5534f
MD5 43c743e0c66683445237f55c8e017b6f
SHA1 c74ce74a73fee60d12f460fcba47ef5de5d0b71b
SHA512 11a4da0c39a01cabd5c0b5b67b5cb951ad295ca8b3c32c26b0db3c691775aa466c1c47d884af241e519c56ee623d1eec79b4d17afb6f526a7c034fe93f5be833
SSDEEP 49152:w/OJDVmiQwNGEADt7i+/yTukuFGNLrkBirx:EOT3vchrSiGdkBirx
TLSH
T1D406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\29D5.tmp
Size 3.6MB
SHA256 daad0dea55c6bc917f7c76c1cc1214a8c0d97fd4842038ec420dbefd0c5630ad
MD5 c890244cf0440731a1acd6e9eb8da219
SHA1 3eb01cecbe267b0af71d9442c9276be389cea990
SHA512 d89f8b41012ab3f03f9ffb57c08d87a589e3a97081378e173d4369b7cc9655bb3c7b955129dbe62c470c1efa8a9053400e1e766735b08ee40d725283b829af84
SSDEEP 49152:w/OJDIzDgNGEADt7i+/yTukuFGNLrkBirx:EOADgchrSiGdkBirx
TLSH
T1DA06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2EE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
Size 3.6MB
SHA256 8c10d3a1469ec2a2ab23f99ec888cfce21b9ab14c4ed46ea1e5540d3f34d3b11
MD5 efd2a5951de48856b2cb300e9443d1e0
SHA1 f96955cdcdcf7f556a58db35126bb6d3706d1946
SHA512 ee91ceeb7d4d64f63190186757de58b647d12935195425f8eca85405906feebb4f6be495d866eb7b4ae7303bab2b638f579fbd7114b79aa7def5c6381a86afa7
SSDEEP 49152:w/OJDylwNGEADt7i+/yTukuFGNLrkBirx:EOMlwchrSiGdkBirx
TLSH
T1C406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2FE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\2FE0.tmp
Size 3.6MB
SHA256 806cdc177fe968b8323018e1ecabd9eba39fdd84fb4dbc15764e8d9e5f77faf9
MD5 4682452c19cc87feddccf7f83dfb8a80
SHA1 4aabab7d8914de0f3bc213a64a8bc0b73831fafb
SHA512 de9dcad22d5135d93df90357447c23a7fa5892ce3243f8791fc67d03976900823e456ae1eadba7acd03db3afb18b484081d0c0bc80e210f746e25a748053f363
SSDEEP 49152:w/OJDrE9F74NGEADt7i+/yTukuFGNLrkBirx:EO5E9V4chrSiGdkBirx
TLSH
T17806831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3399.tmp

Path C:\Users\Admin\AppData\Local\Temp\3399.tmp
Size 3.6MB
SHA256 a96cce1b61194fcf62c39303cb7ee5580deaf9fafd0a3d3668398bd9549632bb
MD5 47a9f001c1a77c9e50582168e4da3913
SHA1 652b15dc0a0aa17a9fbe281353ff688d80d7d39b
SHA512 b2de2f74fb48edd45fe5cb9da163100b5a60729edac893cb2763322d8bea62d43ba0811a40a76a0ba541fe1ddfae085ced6cb1114ae7cf4461b101ed2b34308b
SSDEEP 49152:w/OJDOONzmvANGEADt7i+/yTukuFGNLrkBirx:EOYOdpchrSiGdkBirx
TLSH
T1AC06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\36A6.tmp
Size 3.6MB
SHA256 4ddc16eafc54333dd606bad25f315fa842f20973798ad272e35a694775281b67
MD5 5b368b65c6201f0415c0ee60ee42291a
SHA1 d375a23575875ba2fca6308fdae5e548538afb28
SHA512 fb3ae68c389b5720c5fdfe30c8ff70ff3b7f92159980ae3f568f2317f20c32a41fe9009a9c114d09affbbac672206909d5e7b9da4b23d740d66ec37640f84121
SSDEEP 49152:w/OJDg7v8hH+bNGEADt7i+/yTukuFGNLrkBirx:EOtGchrSiGdkBirx
TLSH
T1B906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\37FE.tmp
Size 3.6MB
SHA256 b7bfcf5521021b9aa4964f0e780e849820f98b83e053b7a1cb731dce4e1a06a0
MD5 dfbddf57229a2c85627886d965966d9b
SHA1 955c017265af4c34efd733b47215e6516d0674ca
SHA512 70ff0eb2a0d4a09214137df48983e0a431728860722ab80cd4c61de488be64cf59f705757a02ae05bb1a9a6e80dbb2b5b4557b96cec949c936554d2f47d0680b
SSDEEP 49152:w/OJD/eH9LpkNGEADt7i+/yTukuFGNLrkBirx:EOM/kchrSiGdkBirx
TLSH
T19E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3C34.tmp

Path C:\Users\Admin\AppData\Local\Temp\3C34.tmp
Size 3.6MB
SHA256 bd7b463e4388332e6c600c96f5043370fe4fff35a95df4004a90d21cb30a6719
MD5 8a80323820fc60e66c3c370bf566cdbf
SHA1 1e9ea4387a05c22daa2af045eefc2d8cacd1a69c
SHA512 27f3d0acd433b9757628c9d0e316ed152fd8e19f3fa482b54afbff232421125f8269df046097b9e134d99fc232895b61543b69eca22efce2c0cac81e3822da86
SSDEEP 49152:w/OJDcyx8u2cNGEADt7i+/yTukuFGNLrkBirx:EOx2cchrSiGdkBirx
TLSH
T16906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3F22.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F22.tmp
Size 3.6MB
SHA256 8abbae489444ba66822095abeb9d88a53b848b33c7c37093cadd516a0c3c8c5b
MD5 73a017ba3679a20061e608fabd327237
SHA1 d42e8f59daca66b929280f729d03c03530ad4e8a
SHA512 2e8c980a26bb122ff0560ea5d78211499048f284fe5503ae3d229c64360b1f06c4a160596e6808e9194b1f9afcc876ed95cd5fee288426bf64afc2ce98fa98ab
SSDEEP 49152:w/OJDhcPQGrNGEADt7i+/yTukuFGNLrkBirx:EOv8chrSiGdkBirx
TLSH
T11806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\42BC.tmp
Size 3.6MB
SHA256 e3343e91ec3c0c74993c8f759655707b64e9aaf5ad2deb293b567b7419415660
MD5 51e48efa217760772c321c99502c77cd
SHA1 206e7bfe61a6db0684d88aad1990eae79b790f99
SHA512 dbf90518b7fcf0266a4f751d849b33902687a1360196573f66360940f4c10db3c413f0bcd5a443afecdcd60bf8ba07190ec4ec2815d07ec947bf8e91e55c2745
SSDEEP 49152:w/OJD+dzoMFNGEADt7i+/yTukuFGNLrkBirx:EO2EechrSiGdkBirx
TLSH
T13806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4404.tmp

Path C:\Users\Admin\AppData\Local\Temp\4404.tmp
Size 3.6MB
SHA256 e135ea043aaaed40933642e07d02d98d506b65fc176a5c0dd7c527bfc65649f6
MD5 8fa382018cb7476fa8513ede54556e76
SHA1 6a98ba9c12dec63482c4b47f74623d2078336d7d
SHA512 1b1ca70368d520d09fc435d0f425a53aaba0a1a14e6f5e63ac1e5c7007d3b65a97ddbacf384299d3c1fed0a1e497133cef6a22d1a062bcc797c6eadc04f2e972
SSDEEP 49152:w/OJDSeWaTNGEADt7i+/yTukuFGNLrkBirx:EOBWaTchrSiGdkBirx
TLSH
T13E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\47BD.tmp
Size 3.6MB
SHA256 28000cf94d98c779b2d79126cc6b0211efb941be01763536d39926ec3f5dd1bb
MD5 c1a94b8d919b1a394e67a20487fd63c3
SHA1 5a0427e1497a1143ad5a1a43e44677827c6d6318
SHA512 1cfb1b01f0dd5090df1b04034715bb930af7b50c16b877022e20c2b85c0cf293b81c88fcd5997a1db0e07d5c2d0b7961676ec13ffeb42a7ffb8cdfa071b70410
SSDEEP 49152:w/OJDQGkYNGEADt7i+/yTukuFGNLrkBirx:EOhnchrSiGdkBirx
TLSH
T14706831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4A6D.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A6D.tmp
Size 3.6MB
SHA256 996ed7f09f33bac58150ac1b18c90f666d0683236cfedffe19bb115ec517cb25
MD5 5d676dbc08036946c4373452d3011454
SHA1 7b774daadd83c5f61ff81014758f88182157e077
SHA512 79ceb513dc1655cc27e503dc7c84e24f9079cd17c9d2cfdbd3b1e814423f8af07f6329b8ee4b33fe17d373ce8ae3d01ffd2bbb663458eab9de083fd6640fa317
SSDEEP 49152:w/OJDk8vd80/pcBA+LNGEADt7i+/yTukuFGNLrkBirx:EOrK0/pcBA+LchrSiGdkBirx
TLSH
T12206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D2C.tmp
Size 3.6MB
SHA256 632c46f8e6ffd9f8df7acfb6d3f47743b74d43cc65dd3f8f3227743d9af6d530
MD5 9d2f67bf47928f797a33ff6e8670c072
SHA1 0ae5e077b4e788cd7e6814c82eb15562adef4ffe
SHA512 9bd9152ccd1c5647a1d4b797c4ab5d3080ccb236470b90b92e8f4b8ab805a98e3bfeeb3c90737759b3b043ae7404d33224a3ec240b0730ad1155684d53463893
SSDEEP 49152:w/OJDiLtM+S7RNGEADt7i+/yTukuFGNLrkBirx:EOCAchrSiGdkBirx
TLSH
T16506931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4FFB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FFB.tmp
Size 3.6MB
SHA256 023d522489d95df326cdbb0df990fbb002e685d25dfbc876d77cd66744f11eb6
MD5 4fceb488ee9d33b29bc9c9cbee980a39
SHA1 1c2db88a7d7cac4d7831d353c9f1eeca66586159
SHA512 7238db8ed717b2ed103a13aad69838e4d29e157a15c8d38a994aa5e8e02016a9aa3233333076930f931b918bc6f32fafa36ebaa5e0e76f00c04e1b4158864c92
SSDEEP 49152:w/OJDc/+J64SNGEADt7i+/yTukuFGNLrkBirx:EO6chrSiGdkBirx
TLSH
T1B106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52D9.tmp

Path C:\Users\Admin\AppData\Local\Temp\52D9.tmp
Size 3.6MB
SHA256 b8d2724fb6e523951d8d207159168a4df8092cdab4eb40275f426cdd33ec3726
MD5 ecbc25ac36063d4ccc64b1dacffb4260
SHA1 900dff927b01b1ec7302b321b5530445acc2e8c1
SHA512 94bb80ac3006c0fd0069950986f3bcc88ea55c6d197a3c57aba01bd1d60a5c0809bdac6b012997a634372ce36348e963234be5ddaccd7a46325d92a9416e4f63
SSDEEP 49152:w/OJDtbZrpQUJ2NGEADt7i+/yTukuFGNLrkBirx:EOD9/4chrSiGdkBirx
TLSH
T1AC06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5579.tmp

Path C:\Users\Admin\AppData\Local\Temp\5579.tmp
Size 3.6MB
SHA256 0ff7e7e067ce721f1316160723fb024d263a5bf710f6269ad8e1a08e4c92b3e4
MD5 6a4d2f6ee228247a62049b616d7032cc
SHA1 f4834dd2d5d4ab926f63b0a3b62488bd6ed89387
SHA512 caea7f4170e43865e07663b479ce637fe627b31abacedbdc196c4533736d5365ec1a4bc5bd572dd667263c7bb232ba787ac011cd5156280d2b8115811fcabd7e
SSDEEP 49152:w/OJDueVGuNGEADt7i+/yTukuFGNLrkBirx:EOMeVGuchrSiGdkBirx
TLSH
T1D506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5838.tmp

Path C:\Users\Admin\AppData\Local\Temp\5838.tmp
Size 3.6MB
SHA256 35e3a62ca0790e67792405bdfe8ef540381ba39da5002e347801c75b0164e246
MD5 e8df3a3683153ca4b259d496dc829e33
SHA1 0c3016d21ea2f9771080f7dfcef3632bc86109ff
SHA512 898499270b3f43a74bfd28df5e8ddcce264cadd3255fed241433587230c58fb6f8ba3eff192d2cdd3f516ab2e874d6363b23de78b89f20557433ed5596fe8fce
SSDEEP 49152:w/OJD6Vg8NGEADt7i+/yTukuFGNLrkBirx:EOMchrSiGdkBirx
TLSH
T11506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AA9.tmp

Path C:\Users\Admin\AppData\Local\Temp\5AA9.tmp
Size 3.6MB
SHA256 64a9fc679ac666ddd6ae390faa777b26cc6be5e76c29f6c8e51503423ad93f88
MD5 e141fd87dfdd869ba6b7c7909e952b13
SHA1 ebd40bcb022d74f05e9962123fdac09ad2283f94
SHA512 cecab24193a36726a50991d84037731b9ca7db2dd9d84ff7d0201c0f8bf3801a0922c88b2052bc8c682a0bf9ea220dd0016db8654e002068737706eea3447b6e
SSDEEP 49152:w/OJD9aKFu+NGEADt7i+/yTukuFGNLrkBirx:EOLFFu+chrSiGdkBirx
TLSH
T13406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5D68.tmp

Path C:\Users\Admin\AppData\Local\Temp\5D68.tmp
Size 3.6MB
SHA256 765d0a4752beeec30b879e9ad4acfe91f15ac7eb23d307e60e6f575377f4ba55
MD5 fe7d9612afd72bf7bd966e02c79fda8e
SHA1 d563e908f4dcdf2c13df036ff92147e6b3e00f5c
SHA512 8150a86003fb54b61ca5dd92135cd35a7ff8f539495f55f159fa0efc6fb17fb00718070e6f8eada505e6c430a8ddf9f08ff9422d977c05507e3fb9d79a42962a
SSDEEP 49152:w/OJDsnG6NGEADt7i+/yTukuFGNLrkBirx:EOGnG6chrSiGdkBirx
TLSH
T16C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E91.tmp

Path C:\Users\Admin\AppData\Local\Temp\5E91.tmp
Size 3.6MB
SHA256 c0cd93351c19d6909bc408cae055c18c27cad672fd664c10f6c5db7a4945e2dc
MD5 a96945fc934ad547d6702af71611322e
SHA1 63948f929b36c9f63679b33d468e13a58248de17
SHA512 0ebbefb504fddd87fa0b25d4a7496b4bae46a8e338a7dc614e400859a2f353be42e24f4bea45131447550e7af154d4676988a8b0fd872b4195e4cf74fa225e4b
SSDEEP 49152:w/OJDKQArPi/sjNGEADt7i+/yTukuFGNLrkBirx:EO/ArIochrSiGdkBirx
TLSH
T15706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6373.tmp

Path C:\Users\Admin\AppData\Local\Temp\6373.tmp
Size 3.6MB
SHA256 0a1a7a4efe6d2b54dc011c3a9625b3fd54f85796e827ca279bca022ffdc2278c
MD5 aea57e91047f9136e08239a16b7aee93
SHA1 79736607b93f1517dde019513c0569a22a92948f
SHA512 d1659f38f7e2d1e1c09441ef295434adc6cdb259f860e34e699efa3e8679d4bb7f3ad37fc99ff14076c8b368aa8dac55bd9ccb62c39c1e4a6bf1414b0dd7e48e
SSDEEP 49152:w/OJD7LZM4kMNGEADt7i+/yTukuFGNLrkBirx:EONfkMchrSiGdkBirx
TLSH
T1E406831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6680.tmp

Path C:\Users\Admin\AppData\Local\Temp\6680.tmp
Size 3.6MB
SHA256 2f4dc558e2cc6f832735440d9aff7d657f7057f51a21cd6d7d937eb8208c5d17
MD5 29a91c70cca06d15628be8eda17e619f
SHA1 651a16d554be3afcaa92ae20939c13a752b02cd5
SHA512 16cfe37b70a811faae0b45a3ead4b48e3e2ae536773309a216a58ba1bb4d22b08ad6655059940a688696cf25f2c29039233f8c5a4c3e3eb63043b3194fb17555
SSDEEP 49152:w/OJDnpENGEADt7i+/yTukuFGNLrkBirx:EOjEchrSiGdkBirx
TLSH
T19706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6930.tmp

Path C:\Users\Admin\AppData\Local\Temp\6930.tmp
Size 3.6MB
SHA256 21ff3e4197b5714d8bebd782097863b91c6e4c6c46449df764db14b988e7ae57
MD5 e08903fb92cb80ded9ae501eff50416b
SHA1 6c9f0b2aa11754c227e23f8ba447c4bfe6cc521f
SHA512 d2292bbf62c13257524fb5cbf4361cbd64af6514d39bdbe7a46a822febc72b94bb883e594e4b3a56421bac8fd1db505820ca55a310275fa6beaac7b9b947f0d9
SSDEEP 49152:w/OJDsYSNGEADt7i+/yTukuFGNLrkBirx:EOmchrSiGdkBirx
TLSH
T16706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6BDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\6BDF.tmp
Size 3.6MB
SHA256 2bc986666c88e4a05adb967c4a9dd19dd8192d61b46560358cfbda9596d8ebf1
MD5 f54a14a10e0ea4e318d3179f407842d1
SHA1 e8df8cefc024a7801360ec9ea6f56a815301cd1f
SHA512 d7e5f273146fdf3e13694203910c6cfbed38abb5dc4fd0d15d1d52c884174f0c43403370c1111b5943e6da38b775a2f868fd9fae38aa06ad88bb8039f87956a8
SSDEEP 49152:w/OJDqRN1utgRNGEADt7i+/yTukuFGNLrkBirx:EO0RitWchrSiGdkBirx
TLSH
T15106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6E9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E9E.tmp
Size 3.6MB
SHA256 151f75da49b9dcec2d696e47b35769503fde94283da7581ca49b58e546d1ec4c
MD5 d5668e1aba9380be6af37ab4fe9abb7c
SHA1 8d2e3ce20bac4266cba4df06ebc9dfe3ce4815a1
SHA512 465ce413865408f5b18c9420a85a7d4b3ca0ea66da6cafaf0f012240e67e939f1dd04645eb6aa0e28dc25191ecc28ae67f0fbd90c04ac8d56442c9a7459cd26b
SSDEEP 49152:w/OJDof+2kNGEADt7i+/yTukuFGNLrkBirx:EOikchrSiGdkBirx
TLSH
T1B206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

715E.tmp

Path C:\Users\Admin\AppData\Local\Temp\715E.tmp
Size 3.6MB
SHA256 86b4f9b96b2888990b32834e423b88dd489cf13607661be281427dbb8b29a859
MD5 ae1b83d89678de9ac6752751ee6fd9af
SHA1 9df346c578eac0115a882f2d100e02d0863c3927
SHA512 0ca3a9bb4f1a5fb92c07de34ed7050d778a342846608a1b90fe06185d06d5d30ffb376e4255fb699cb8735098253906d94e8a5102352380ffe73502917fa170b
SSDEEP 49152:w/OJD+1U8V8+zNGEADt7i+/yTukuFGNLrkBirx:EO41F8EchrSiGdkBirx
TLSH
T18E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\73DE.tmp
Size 3.6MB
SHA256 927b3c4c650762063ff5015768dd37dad10fe7b6c4dca14075e5e02b60f8a1ff
MD5 76808cd8990bead8052f2a0005e05980
SHA1 4627d625f340bbe5ad58ab7521fd17060f08a21f
SHA512 a3055dc10a3a42beacfcc61b0b1fb6ff825a2bbf1e20c4d4ca9e53aa6395fd097e02cc80a334f83f2aecb591812f295050094b7cf9e12f8efce5c3b7bb445fa7
SSDEEP 49152:w/OJDZtqpNGEADt7i+/yTukuFGNLrkBirx:EOkpchrSiGdkBirx
TLSH
T14306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\74F7.tmp
Size 3.6MB
SHA256 ff06a0ccf71ab839bcf9f82e3bdff896d800b58565f97d4792d53e0912e43998
MD5 5d336573a1d4a6432443d828605c8b15
SHA1 9f091b3b9560bb52ff780e7819d37a0440bbcbce
SHA512 d756b463b9d7e6fa6bfc6b0a7403e8e2bba2a5b08a60956c80e98b338c880e142272885409bf67dad66e87cf8becd824209d12534ab503f81ee4eeeeb59b5048
SSDEEP 49152:w/OJDYYwM+NGEADt7i+/yTukuFGNLrkBirx:EOOYochrSiGdkBirx
TLSH
T19F06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

792E.tmp

Path C:\Users\Admin\AppData\Local\Temp\792E.tmp
Size 3.6MB
SHA256 b91c67d0ef60fdac557ef5565946292222426d5467126b3ddb1aef5e1813aa8a
MD5 24c3ad0ffb9424de4ee00156fee97efb
SHA1 beecfbf2ef7d771efc285ce22c9e93cc1d474ac1
SHA512 969fd75542502937617a45a6dbbfb578bb9eda6100d66e1f593984cab561bf1f3b48c9f488ab70fd1c89470f0a5b622002b77816412529c1e00251cf066b214c
SSDEEP 49152:w/OJDlULqeDbatNGEADt7i+/yTukuFGNLrkBirx:EOUqeDutchrSiGdkBirx
TLSH
T1CC06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7BAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\7BAE.tmp
Size 3.6MB
SHA256 f9095ea3d569df2a15b052e97079db7e9974d61887d9dc81990620d0ab95d62e
MD5 bb4821afa078438a9a169a6e3989ceb9
SHA1 7adedb86632520f691dfb4575d9c0c5b4f38a44f
SHA512 375f025bab1a364825141bb7645804b21a82bdef5fdb6c0f2e912936f1e3db5eafb0d70cc865427c2e2fa462328b532a71ce57991f1ae0899f639653867b18b0
SSDEEP 49152:w/OJDLNOE+npIsy2NGEADt7i+/yTukuFGNLrkBirx:EOlNOTnry2chrSiGdkBirx
TLSH
T1D006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E5E.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E5E.tmp
Size 3.6MB
SHA256 83158e451354a3445b36d6a9ceb77e34f089d51398b0e60bee99184bb004f2c4
MD5 a04b29bc870be0283b6b7d37a6d72257
SHA1 908a27a16bb935fd5c32a36eb89e48080c3bb4ca
SHA512 ee65094d0edfdeaa9b375fbe0178e526e6784d1f1f6e828753c684c6161d9c88d48b3a5866b0b1d315bb8ae93b4e6449ea5113e4c2186db7e37980087f3728fc
SSDEEP 49152:w/OJDdCtWnwNGEADt7i+/yTukuFGNLrkBirx:EOPcchrSiGdkBirx
TLSH
T1F206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-97-0x0000000000290000-0x0000000000313000-memory.dmp

Download

memory/236-104-0x0000000000290000-0x0000000000313000-memory.dmp

Download

memory/812-273-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/812-268-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/864-222-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/864-229-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/1064-12-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/1064-21-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/1132-89-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/1132-96-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/1136-216-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/1136-209-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/1144-264-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/1144-269-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/1176-145-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/1176-154-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/1476-48-0x00000000001A0000-0x0000000000223000-memory.dmp

Download

memory/1476-55-0x00000000001A0000-0x0000000000223000-memory.dmp

Download

memory/1932-288-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1932-282-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/2160-201-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/2160-208-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/2236-0-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/2236-6-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/2400-117-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2400-124-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2404-258-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/2404-263-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/2536-196-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/2536-187-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/2552-110-0x0000000000E90000-0x0000000000F13000-memory.dmp

Download

memory/2552-118-0x0000000000E90000-0x0000000000F13000-memory.dmp

Download

memory/2556-62-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/2556-54-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/2664-249-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/2664-243-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/3192-181-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/3192-173-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/3368-82-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/3368-91-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/3400-166-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/3400-175-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/3680-139-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/3680-132-0x00000000001E0000-0x0000000000263000-memory.dmp

Download

memory/3780-194-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/3780-202-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/3836-302-0x00000000005D0000-0x0000000000653000-memory.dmp

Download

memory/3892-233-0x0000000000980000-0x0000000000A03000-memory.dmp

Download

memory/3892-238-0x0000000000980000-0x0000000000A03000-memory.dmp

Download

memory/3920-239-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/3920-244-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/4216-47-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/4216-41-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/4348-5-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/4348-14-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/4360-68-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/4360-76-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/4412-189-0x00000000001F0000-0x0000000000273000-memory.dmp

Download

memory/4412-180-0x00000000001F0000-0x0000000000273000-memory.dmp

Download

memory/4448-254-0x0000000000CF0000-0x0000000000D73000-memory.dmp

Download

memory/4448-248-0x0000000000CF0000-0x0000000000D73000-memory.dmp

Download

memory/4560-61-0x00000000003E0000-0x0000000000463000-memory.dmp

Download

memory/4560-69-0x00000000003E0000-0x0000000000463000-memory.dmp

Download

memory/4680-253-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/4680-259-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/4688-159-0x0000000000E40000-0x0000000000EC3000-memory.dmp

Download

memory/4688-152-0x0000000000E40000-0x0000000000EC3000-memory.dmp

Download

memory/4844-27-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/4844-19-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/4900-75-0x0000000000B00000-0x0000000000B83000-memory.dmp

Download

memory/4900-84-0x0000000000B00000-0x0000000000B83000-memory.dmp

Download

memory/5036-167-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/5036-160-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/5136-274-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/5468-112-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/5468-103-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/5500-215-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/5500-223-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/5504-40-0x0000000000DB0000-0x0000000000E33000-memory.dmp

Download

memory/5504-34-0x0000000000DB0000-0x0000000000E33000-memory.dmp

Download

memory/5548-234-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/5548-228-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/5644-303-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/5644-297-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/5716-298-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/5716-292-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/5760-146-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/5760-138-0x0000000000D90000-0x0000000000E13000-memory.dmp

Download

memory/5872-131-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/5872-125-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/5880-287-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/5880-293-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/5972-283-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/5972-278-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/6120-26-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/6120-33-0x0000000000890000-0x0000000000913000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads