5da989450426047ac798d3155a4578b613a495ff94c861adc3fa43b616b0c352

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_fb8f818208969806ec96c85bbd057736_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260803-g383mszelc
SHA256 5da989450426047ac798d3155a4578b613a495ff94c861adc3fa43b616b0c352
MD5 fb8f818208969806ec96c85bbd057736
SHA1 75ed3b8b3925276c0426acf822d145b857127558
SHA512 cd07892ae5bdd35ff0a3546e3036ca309ecb32c9ebe47f73d092f605e80bebb3dd58c725da6f8c36838330d066d5f12d4592f9f15b5f54d1eff8096dfc29a911
SSDEEP 49152:w/OJDaddipAJNGEADt7i+/yTukuFGNLrkBirx:EOOipKchrSiGdkBirx
TLSH
T17506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4684	F7B4.tmp
3588	F87F.tmp
3988	FC87.tmp
2308	FDCF.tmp
4660	291.tmp
1092	37C.tmp
5336	7B2.tmp
4368	A61.tmp
368	CE2.tmp
4704	FB1.tmp
4580	1251.tmp
2936	151F.tmp
4540	17B0.tmp
3568	1A50.tmp
424	1CD0.tmp
5392	203B.tmp
4812	2174.tmp
2672	2442.tmp
992	279E.tmp
2768	2A9B.tmp
4756	2DE7.tmp
1696	30A6.tmp
5652	324C.tmp
4244	351B.tmp
5780	3847.tmp
1544	3B07.tmp
3468	3D97.tmp
4236	4046.tmp
960	4325.tmp
5492	45C5.tmp
2484	4910.tmp
4360	4BA1.tmp
6076	4E60.tmp
1148	4F2B.tmp
4956	4FF6.tmp
3064	50E0.tmp
1444	51EA.tmp
1928	5313.tmp
1856	540D.tmp
4976	5545.tmp
1256	564F.tmp
3392	5749.tmp
2288	5833.tmp
344	590E.tmp
120	5A66.tmp
1100	5B8F.tmp
480	5C79.tmp
4332	5DA2.tmp
3652	5E7D.tmp
4052	5F38.tmp
3612	6013.tmp
5252	60CE.tmp
3368	61A9.tmp
3236	6294.tmp
2792	634F.tmp
2900	63DC.tmp
2648	6533.tmp
1584	663D.tmp
3084	6708.tmp
1324	67C4.tmp
1548	689E.tmp
4340	6989.tmp
4984	6A44.tmp
5628	6B3E.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2442.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5313.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3620.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71D1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80B6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C6C7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6AE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B622.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC29.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2324.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DC5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E58.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	760C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9924.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD1A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	114D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A66.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6294.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3053.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ACE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1871.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	801E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C6DB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55CD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5BB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A402.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2835.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64C1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	203B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F28A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	603.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C5E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B9A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7DFB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D032.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF07.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F87B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28F1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5262.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8EA0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8984.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DE7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F6C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4497.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45EF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F931.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D42.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	260E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_fb8f818208969806ec96c85bbd057736_elex_mafia_poet-rat_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	634F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C38.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A9FD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F2F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6CB1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9883.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F87F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9135.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC69.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B1A.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4684	756	2026-08-03_fb8f818208969806ec96c85bbd057736_elex_mafia_poet-rat_stealc_tofsee.exe	88
PID 4684 wrote to memory of 3588	4684	F7B4.tmp	89
PID 3588 wrote to memory of 3988	3588	F87F.tmp	90
PID 3988 wrote to memory of 2308	3988	FC87.tmp	91
PID 2308 wrote to memory of 4660	2308	FDCF.tmp	92
PID 4660 wrote to memory of 1092	4660	291.tmp	93
PID 1092 wrote to memory of 5336	1092	37C.tmp	94
PID 5336 wrote to memory of 4368	5336	7B2.tmp	95
PID 4368 wrote to memory of 368	4368	A61.tmp	96
PID 368 wrote to memory of 4704	368	CE2.tmp	97
PID 4704 wrote to memory of 4580	4704	FB1.tmp	98
PID 4580 wrote to memory of 2936	4580	1251.tmp	99
PID 2936 wrote to memory of 4540	2936	151F.tmp	100
PID 4540 wrote to memory of 3568	4540	17B0.tmp	101
PID 3568 wrote to memory of 424	3568	1A50.tmp	102
PID 424 wrote to memory of 5392	424	1CD0.tmp	103
PID 5392 wrote to memory of 4812	5392	203B.tmp	104
PID 4812 wrote to memory of 2672	4812	2174.tmp	105
PID 2672 wrote to memory of 992	2672	2442.tmp	106
PID 992 wrote to memory of 2768	992	279E.tmp	107
PID 2768 wrote to memory of 4756	2768	2A9B.tmp	108
PID 4756 wrote to memory of 1696	4756	2DE7.tmp	109
PID 1696 wrote to memory of 5652	1696	30A6.tmp	110
PID 5652 wrote to memory of 4244	5652	324C.tmp	111
PID 4244 wrote to memory of 5780	4244	351B.tmp	112
PID 5780 wrote to memory of 1544	5780	3847.tmp	113
PID 1544 wrote to memory of 3468	1544	3B07.tmp	114
PID 3468 wrote to memory of 4236	3468	3D97.tmp	115
PID 4236 wrote to memory of 960	4236	4046.tmp	116
PID 960 wrote to memory of 5492	960	4325.tmp	117
PID 5492 wrote to memory of 2484	5492	45C5.tmp	118
PID 2484 wrote to memory of 4360	2484	4910.tmp	119
PID 4360 wrote to memory of 6076	4360	4BA1.tmp	120
PID 6076 wrote to memory of 1148	6076	4E60.tmp	121
PID 1148 wrote to memory of 4956	1148	4F2B.tmp	122
PID 4956 wrote to memory of 3064	4956	4FF6.tmp	123
PID 3064 wrote to memory of 1444	3064	50E0.tmp	124
PID 1444 wrote to memory of 1928	1444	51EA.tmp	125
PID 1928 wrote to memory of 1856	1928	5313.tmp	126
PID 1856 wrote to memory of 4976	1856	540D.tmp	127
PID 4976 wrote to memory of 1256	4976	5545.tmp	128
PID 1256 wrote to memory of 3392	1256	564F.tmp	129
PID 3392 wrote to memory of 2288	3392	5749.tmp	130
PID 2288 wrote to memory of 344	2288	5833.tmp	131
PID 344 wrote to memory of 120	344	590E.tmp	132
PID 120 wrote to memory of 1100	120	5A66.tmp	133
PID 1100 wrote to memory of 480	1100	5B8F.tmp	134
PID 480 wrote to memory of 4332	480	5C79.tmp	135
PID 4332 wrote to memory of 3652	4332	5DA2.tmp	136
PID 3652 wrote to memory of 4052	3652	5E7D.tmp	137
PID 4052 wrote to memory of 3612	4052	5F38.tmp	138
PID 3612 wrote to memory of 5252	3612	6013.tmp	139
PID 5252 wrote to memory of 3368	5252	60CE.tmp	140
PID 3368 wrote to memory of 3236	3368	61A9.tmp	141
PID 3236 wrote to memory of 2792	3236	6294.tmp	142
PID 2792 wrote to memory of 2900	2792	634F.tmp	143
PID 2900 wrote to memory of 2648	2900	63DC.tmp	144
PID 2648 wrote to memory of 1584	2648	6533.tmp	145
PID 1584 wrote to memory of 3084	1584	663D.tmp	146
PID 3084 wrote to memory of 1324	3084	6708.tmp	147
PID 1324 wrote to memory of 1548	1324	67C4.tmp	148
PID 1548 wrote to memory of 4340	1548	689E.tmp	149
PID 4340 wrote to memory of 4984	4340	6989.tmp	150
PID 4984 wrote to memory of 5628	4984	6A44.tmp	151

C:\Users\Admin\AppData\Local\Temp\2026-08-03_fb8f818208969806ec96c85bbd057736_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_fb8f818208969806ec96c85bbd057736_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\F7B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\F87F.tmp
    "C:\Users\Admin\AppData\Local\Temp\F87F.tmp"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\FC87.tmp
      "C:\Users\Admin\AppData\Local\Temp\FC87.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\FDCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\37C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37C.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\7B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B2.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\A61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A61.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\CE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE2.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB1.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\1251.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1251.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\151F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\151F.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\17B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B0.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\1A50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A50.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\1CD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\203B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\203B.tmp"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\2174.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2174.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\2442.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2442.tmp"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\279E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279E.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\2A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\2DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\30A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30A6.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\324C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\324C.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\351B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\351B.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\3847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3847.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\3B07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B07.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\3D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D97.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\4046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4046.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\4325.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4325.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\45C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C5.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\4910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4910.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\4BA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\4E60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E60.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\4F2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\4FF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\50E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50E0.tmp"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\51EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51EA.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\5313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5313.tmp"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\540D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\540D.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\5545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5545.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\564F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\564F.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\5749.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5749.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\5833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5833.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\590E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\590E.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\5A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A66.tmp"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\5B8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\5C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C79.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\5DA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\5E7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\5F38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F38.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\6013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6013.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\60CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60CE.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\61A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61A9.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\6294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6294.tmp"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\634F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\634F.tmp"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\63DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63DC.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\6533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6533.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\663D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\663D.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\6708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6708.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\67C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67C4.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\689E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\689E.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\6989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6989.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\6A44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A44.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\6B3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"
        65⤵
        Executes dropped EXE
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\6C38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C38.tmp"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\6D42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D42.tmp"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\6E0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E0D.tmp"
        68⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\6F07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F07.tmp"
        69⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\6FB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"
        70⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\705F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\705F.tmp"
        71⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\710B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\710B.tmp"
        72⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\71C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71C6.tmp"
        73⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\7282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7282.tmp"
        74⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\733D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\733D.tmp"
        75⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\73E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73E9.tmp"
        76⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\74A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74A5.tmp"
        77⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\7550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7550.tmp"
        78⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\760C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\760C.tmp"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\76D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76D7.tmp"
        80⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\77D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77D1.tmp"
        81⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\788D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\788D.tmp"
        82⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\7958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7958.tmp"
        83⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\7A13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A13.tmp"
        84⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\7ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"
        85⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\7B9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\7C46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C46.tmp"
        87⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\7D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D30.tmp"
        88⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\7DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\7EA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EA7.tmp"
        90⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\7F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F63.tmp"
        91⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\801E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\801E.tmp"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\80DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80DA.tmp"
        93⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\8195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8195.tmp"
        94⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\8260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8260.tmp"
        95⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\830C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\830C.tmp"
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\83E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83E7.tmp"
        97⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\84A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84A2.tmp"
        98⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\854E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\854E.tmp"
        99⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\85EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85EA.tmp"
        100⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\86A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86A6.tmp"
        101⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\8752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8752.tmp"
        102⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\87FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87FE.tmp"
        103⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\88C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88C9.tmp"
        104⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\8984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8984.tmp"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\8A4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"
        106⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\8B0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"
        107⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\8BD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BD6.tmp"
        108⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\8CA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"
        109⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\8D8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D8C.tmp"
        110⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\8E37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E37.tmp"
        111⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\8EE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"
        112⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\8FAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FAE.tmp"
        113⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\905A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905A.tmp"
        114⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\9135.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9135.tmp"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\9200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9200.tmp"
        116⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\96E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96E2.tmp"
        117⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\979E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\979E.tmp"
        118⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\9869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9869.tmp"
        119⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\9924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9924.tmp"
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\99EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99EF.tmp"
        121⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\9ABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9ABB.tmp"
        122⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\9B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B76.tmp"
        123⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\9C41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C41.tmp"
        124⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\9D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D0C.tmp"
        125⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\9DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DE7.tmp"
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\9E93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E93.tmp"
        127⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\9F4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"
        128⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\A029.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A029.tmp"
        129⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\A0F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0F4.tmp"
        130⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\A1CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1CF.tmp"
        131⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\A2B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2B9.tmp"
        132⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\A375.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A375.tmp"
        133⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\A402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A402.tmp"
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\A4DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4DC.tmp"
        135⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\A5A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"
        136⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\A692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A692.tmp"
        137⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\A76D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A76D.tmp"
        138⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\A838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A838.tmp"
        139⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\A903.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A903.tmp"
        140⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\A9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9FD.tmp"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\AAA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAA9.tmp"
        142⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\AB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB55.tmp"
        143⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\AC4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"
        144⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\AD1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\ADE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADE5.tmp"
        146⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\AEA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"
        147⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\AF9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF9A.tmp"
        148⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\B046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B046.tmp"
        149⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\B131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B131.tmp"
        150⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\B1FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"
        151⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\B2C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"
        152⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\B382.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B382.tmp"
        153⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\B44D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B44D.tmp"
        154⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\B538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B538.tmp"
        155⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\B622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B622.tmp"
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\B6DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6DE.tmp"
        157⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\B7B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7B8.tmp"
        158⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\B864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B864.tmp"
        159⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\B92F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B92F.tmp"
        160⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\B9DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9DB.tmp"
        161⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\BAD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAD5.tmp"
        162⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\BB91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB91.tmp"
        163⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\BC6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"
        164⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\BD46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD46.tmp"
        165⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\BE11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE11.tmp"
        166⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\BEDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEDD.tmp"
        167⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\BFE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFE6.tmp"
        168⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\C0A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0A2.tmp"
        169⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\C14E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C14E.tmp"
        170⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\C209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C209.tmp"
        171⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\C2D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D4.tmp"
        172⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\C3AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3AF.tmp"
        173⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\C46A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46A.tmp"
        174⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\C545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C545.tmp"
        175⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\C610.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C610.tmp"
        176⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\C6DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6DB.tmp"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\C7B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7B6.tmp"
        178⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\C872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C872.tmp"
        179⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\C92D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C92D.tmp"
        180⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\C9F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9F8.tmp"
        181⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\CAC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAC3.tmp"
        182⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\CB8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB8F.tmp"
        183⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\CC69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC69.tmp"
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\CD15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD15.tmp"
        185⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\CDE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDE0.tmp"
        186⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\CEAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEAB.tmp"
        187⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\CF67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF67.tmp"
        188⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\D032.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D032.tmp"
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\D10D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D10D.tmp"
        190⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\D1C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1C8.tmp"
        191⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\D2A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2A3.tmp"
        192⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\D34F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D34F.tmp"
        193⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\D40A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D40A.tmp"
        194⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\D4C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4C6.tmp"
        195⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\D572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D572.tmp"
        196⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\D62D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D62D.tmp"
        197⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\D6E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6E9.tmp"
        198⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\D7A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7A4.tmp"
        199⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\D860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D860.tmp"
        200⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\D91B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D91B.tmp"
        201⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\DA15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA15.tmp"
        202⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\DAC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAC1.tmp"
        203⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\DB6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB6D.tmp"
        204⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\DC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC29.tmp"
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\DCD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCD4.tmp"
        206⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\DD80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD80.tmp"
        207⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\DE2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE2C.tmp"
        208⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\DF07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF07.tmp"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\DFB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFB3.tmp"
        210⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\E07E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E07E.tmp"
        211⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\E139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E139.tmp"
        212⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\E1F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1F5.tmp"
        213⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\E2C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2C0.tmp"
        214⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\E36C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E36C.tmp"
        215⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\E427.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E427.tmp"
        216⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\E4F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4F3.tmp"
        217⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\E5BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5BE.tmp"
        218⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\E698.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E698.tmp"
        219⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\E764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E764.tmp"
        220⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\E81F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E81F.tmp"
        221⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\E8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8CB.tmp"
        222⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\E9B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9B5.tmp"
        223⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\EA80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA80.tmp"
        224⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\EB3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB3C.tmp"
        225⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\EC17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC17.tmp"
        226⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\ECF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECF1.tmp"
        227⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\EDCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"
        228⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\EE78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE78.tmp"
        229⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\EF53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF53.tmp"
        230⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\F02E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F02E.tmp"
        231⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\F0E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0E9.tmp"
        232⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\F1B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1B4.tmp"
        233⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\F27F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F27F.tmp"
        234⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\F379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F379.tmp"
        235⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\F435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F435.tmp"
        236⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\F510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F510.tmp"
        237⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\F5CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5CB.tmp"
        238⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\F6C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6C5.tmp"
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\F7BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7BF.tmp"
        240⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\F87B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F87B.tmp"
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\F946.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F946.tmp"
        242⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\FA11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA11.tmp"
        243⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\FAEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAEC.tmp"
        244⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\FBC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBC6.tmp"
        245⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\FC82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC82.tmp"
        246⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\FD4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD4D.tmp"
        247⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\FE18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE18.tmp"
        248⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\FF51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF51.tmp"
        249⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C.tmp"
        250⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7.tmp"
        251⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\183.tmp"
        252⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\28D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D.tmp"
        253⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\367.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\367.tmp"
        254⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\442.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\442.tmp"
        255⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\4FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE.tmp"
        256⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\5C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C9.tmp"
        257⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\6A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A4.tmp"
        258⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\77E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E.tmp"
        259⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\83A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83A.tmp"
        260⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\924.tmp"
        261⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\9EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF.tmp"
        262⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9B.tmp"
        263⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\B66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B66.tmp"
        264⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C22.tmp"
        265⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\CDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDD.tmp"
        266⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D99.tmp"
        267⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64.tmp"
        268⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\F2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2F.tmp"
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\FEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEB.tmp"
        270⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\10B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10B6.tmp"
        271⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\1171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1171.tmp"
        272⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\125C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\125C.tmp"
        273⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\1317.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1317.tmp"
        274⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\13D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13D3.tmp"
        275⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\149E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\149E.tmp"
        276⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\1588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1588.tmp"
        277⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\1634.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1634.tmp"
        278⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\16EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16EF.tmp"
        279⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\17CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17CA.tmp"
        280⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\1886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1886.tmp"
        281⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\1970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1970.tmp"
        282⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\1A2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A2C.tmp"
        283⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\1AF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AF7.tmp"
        284⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\1BA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BA3.tmp"
        285⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\1C5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C5E.tmp"
        286⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\1D48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D48.tmp"
        287⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\1DF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DF4.tmp"
        288⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\1EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EA0.tmp"
        289⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\1F7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F7B.tmp"
        290⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\2017.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2017.tmp"
        291⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\20D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20D3.tmp"
        292⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\218E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\218E.tmp"
        293⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\2269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2269.tmp"
        294⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\2324.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2324.tmp"
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\23E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23E0.tmp"
        296⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\24AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24AB.tmp"
        297⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\2557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2557.tmp"
        298⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\2612.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2612.tmp"
        299⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\26CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26CE.tmp"
        300⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\27A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27A9.tmp"
        301⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\2835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2835.tmp"
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\28F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28F1.tmp"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\299D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\299D.tmp"
        304⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\2A68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A68.tmp"
        305⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\2B04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B04.tmp"
        306⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\2BC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC0.tmp"
        307⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\2C7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C7B.tmp"
        308⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\2D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D37.tmp"
        309⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\2E11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E11.tmp"
        310⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\2EBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EBD.tmp"
        311⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\2F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F79.tmp"
        312⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\3053.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3053.tmp"
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\30FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30FF.tmp"
        314⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\31AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31AB.tmp"
        315⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\3267.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3267.tmp"
        316⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\3341.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3341.tmp"
        317⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\33ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33ED.tmp"
        318⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\34A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34A9.tmp"
        319⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\3555.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3555.tmp"
        320⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\3620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3620.tmp"
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\36CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36CC.tmp"
        322⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\3778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3778.tmp"
        323⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\3833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3833.tmp"
        324⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\38EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38EF.tmp"
        325⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\39AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39AA.tmp"
        326⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\3A46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A46.tmp"
        327⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\3AF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AF2.tmp"
        328⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\3BAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BAE.tmp"
        329⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\3C5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C5A.tmp"
        330⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\3D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D25.tmp"
        331⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\3DD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DD1.tmp"
        332⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\3E9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E9C.tmp"
        333⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        334⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\4022.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4022.tmp"
        335⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\40DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40DE.tmp"
        336⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\41A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41A9.tmp"
        337⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\4255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4255.tmp"
        338⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\4301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4301.tmp"
        339⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\43CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43CC.tmp"
        340⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\4497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4497.tmp"
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\4543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4543.tmp"
        342⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\45EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45EF.tmp"
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\46AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46AA.tmp"
        344⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\4775.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4775.tmp"
        345⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\4831.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4831.tmp"
        346⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\48EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48EC.tmp"
        347⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\49A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49A8.tmp"
        348⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\4A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A73.tmp"
        349⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\4B1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B1F.tmp"
        350⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\4BFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BFA.tmp"
        351⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\4CA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CA5.tmp"
        352⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\4D61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D61.tmp"
        353⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\4E1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E1C.tmp"
        354⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\4ED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ED8.tmp"
        355⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\4F84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F84.tmp"
        356⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\5030.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5030.tmp"
        357⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\50EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50EB.tmp"
        358⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\51A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51A7.tmp"
        359⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\5262.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5262.tmp"
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\530E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\530E.tmp"
        361⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\53AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AA.tmp"
        362⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\5456.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5456.tmp"
        363⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\5502.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5502.tmp"
        364⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\55CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55CD.tmp"
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\5679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5679.tmp"
        366⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\5725.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5725.tmp"
        367⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\57E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57E0.tmp"
        368⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\58AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58AC.tmp"
        369⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\5957.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5957.tmp"
        370⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\5A13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A13.tmp"
        371⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\5ACE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ACE.tmp"
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\5B7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B7A.tmp"
        373⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\5C55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C55.tmp"
        374⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\5D01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D01.tmp"
        375⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\5D9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D9D.tmp"
        376⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\5E49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E49.tmp"
        377⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\5F05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F05.tmp"
        378⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\5FC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FC0.tmp"
        379⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\607C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\607C.tmp"
        380⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\6147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6147.tmp"
        381⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\61E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61E3.tmp"
        382⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\629E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\629E.tmp"
        383⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\635A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\635A.tmp"
        384⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\6406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6406.tmp"
        385⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\64C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C1.tmp"
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\657D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\657D.tmp"
        387⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\6619.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6619.tmp"
        388⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\66D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66D5.tmp"
        389⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\6780.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6780.tmp"
        390⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\683C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\683C.tmp"
        391⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\6907.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6907.tmp"
        392⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\69A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69A3.tmp"
        393⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\6A5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A5F.tmp"
        394⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\6B1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B1A.tmp"
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\6BF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BF5.tmp"
        396⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\6CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CB1.tmp"
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\6D7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D7C.tmp"
        398⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\6E08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E08.tmp"
        399⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\6ED3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6ED3.tmp"
        400⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\6F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F9F.tmp"
        401⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\706A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\706A.tmp"
        402⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\7106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7106.tmp"
        403⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\71D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71D1.tmp"
        404⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\728D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\728D.tmp"
        405⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\7338.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7338.tmp"
        406⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\73E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73E4.tmp"
        407⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\74A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74A0.tmp"
        408⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\755B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\755B.tmp"
        409⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\7617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7617.tmp"
        410⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\76A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76A3.tmp"
        411⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\774F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\774F.tmp"
        412⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\781A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\781A.tmp"
        413⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\78D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78D6.tmp"
        414⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\7982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7982.tmp"
        415⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\7A3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A3D.tmp"
        416⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\7AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AF9.tmp"
        417⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\7BB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BB4.tmp"
        418⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\7C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C70.tmp"
        419⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\7D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"
        420⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\7DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"
        421⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\7EA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"
        422⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\7F4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F4E.tmp"
        423⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\800A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800A.tmp"
        424⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\80B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80B6.tmp"
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\8142.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8142.tmp"
        426⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\820D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\820D.tmp"
        427⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\82C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82C9.tmp"
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\8384.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8384.tmp"
        429⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\844F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\844F.tmp"
        430⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\84EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84EC.tmp"
        431⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\8598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8598.tmp"
        432⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\8643.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8643.tmp"
        433⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\86EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86EF.tmp"
        434⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\877C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\877C.tmp"
        435⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\8837.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8837.tmp"
        436⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\88F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88F3.tmp"
        437⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\89BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89BE.tmp"
        438⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\8A5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A5A.tmp"
        439⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\8B06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B06.tmp"
        440⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\8BA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BA2.tmp"
        441⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\8C5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C5E.tmp"
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\8D19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D19.tmp"
        443⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\8DC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DC5.tmp"
        444⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\8EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA0.tmp"
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\8F4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F4C.tmp"
        446⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\9017.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9017.tmp"
        447⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\90C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90C3.tmp"
        448⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\918E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\918E.tmp"
        449⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\923A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\923A.tmp"
        450⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\92E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92E6.tmp"
        451⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\93A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93A1.tmp"
        452⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\944D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\944D.tmp"
        453⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\94F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94F9.tmp"
        454⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\95B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95B5.tmp"
        455⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\9660.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9660.tmp"
        456⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\972C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\972C.tmp"
        457⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\97C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97C8.tmp"
        458⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\9883.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9883.tmp"
        459⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\996E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\996E.tmp"
        460⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\9A1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A1A.tmp"
        461⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\9AC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AC5.tmp"
        462⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\9B71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B71.tmp"
        463⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\9C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C2D.tmp"
        464⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\9CC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CC9.tmp"
        465⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\9DB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DB3.tmp"
        466⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\9E7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E7F.tmp"
        467⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\9F3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F3A.tmp"
        468⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\9FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FE6.tmp"
        469⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\A092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A092.tmp"
        470⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\A14D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A14D.tmp"
        471⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\A209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A209.tmp"
        472⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\A2C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2C4.tmp"
        473⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\A380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A380.tmp"
        474⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\A43B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A43B.tmp"
        475⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\A4D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4D8.tmp"
        476⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\A593.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A593.tmp"
        477⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\A63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A63F.tmp"
        478⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\A6EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6EB.tmp"
        479⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\A797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A797.tmp"
        480⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\A871.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A871.tmp"
        481⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\A94C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A94C.tmp"
        482⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\AA08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA08.tmp"
        483⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\AAC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAC3.tmp"
        484⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\AB9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB9E.tmp"
        485⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\AC69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC69.tmp"
        486⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\AD34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD34.tmp"
        487⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\AE0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE0F.tmp"
        488⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\AEEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEEA.tmp"
        489⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\AFB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFB5.tmp"
        490⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\B070.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B070.tmp"
        491⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\B11C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B11C.tmp"
        492⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\B1D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1D8.tmp"
        493⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\B2C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2C2.tmp"
        494⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\B36E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B36E.tmp"
        495⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\B41A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B41A.tmp"
        496⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\B4F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4F5.tmp"
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\B5CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5CF.tmp"
        498⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\B6AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6AA.tmp"
        499⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\B775.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B775.tmp"
        500⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\B87F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B87F.tmp"
        501⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\B93A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B93A.tmp"
        502⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\BA05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA05.tmp"
        503⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\BAD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAD1.tmp"
        504⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\BB8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB8C.tmp"
        505⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\BC57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC57.tmp"
        506⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\BD22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD22.tmp"
        507⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\BE1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE1C.tmp"
        508⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\BED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BED8.tmp"
        509⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\BF93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF93.tmp"
        510⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\C06E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C06E.tmp"
        511⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\C149.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C149.tmp"
        512⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\C243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C243.tmp"
        513⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\C30E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C30E.tmp"
        514⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\C3BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3BA.tmp"
        515⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\C466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C466.tmp"
        516⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\C531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C531.tmp"
        517⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\C60C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C60C.tmp"
        518⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\C6C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6C7.tmp"
        519⤵
        System Location Discovery: System Language Discovery
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\C792.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C792.tmp"
        520⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\C87D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C87D.tmp"
        521⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\C919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C919.tmp"
        522⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\C9A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"
        523⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\CA9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"
        524⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\CB5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB5B.tmp"
        525⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\CBF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBF7.tmp"
        526⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\CCB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCB3.tmp"
        527⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\CD6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD6E.tmp"
        528⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\CE2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE2A.tmp"
        529⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\CF04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF04.tmp"
        530⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\CFC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFC0.tmp"
        531⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\D08B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D08B.tmp"
        532⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\D147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D147.tmp"
        533⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\D221.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D221.tmp"
        534⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\D2BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2BE.tmp"
        535⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\D369.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D369.tmp"
        536⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\D435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D435.tmp"
        537⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\D500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D500.tmp"
        538⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\D5BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5BB.tmp"
        539⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\D686.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D686.tmp"
        540⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\D742.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D742.tmp"
        541⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\D7EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7EE.tmp"
        542⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\D8B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8B9.tmp"
        543⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\D955.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D955.tmp"
        544⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\DA20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA20.tmp"
        545⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\DADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DADC.tmp"
        546⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\DBA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBA7.tmp"
        547⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\DC62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC62.tmp"
        548⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\DD2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD2D.tmp"
        549⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\DDCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDCA.tmp"
        550⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\DE76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE76.tmp"
        551⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\DF31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF31.tmp"
        552⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\DFED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFED.tmp"
        553⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\E0A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0A8.tmp"
        554⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\E183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E183.tmp"
        555⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\E22F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E22F.tmp"
        556⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\E2EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2EA.tmp"
        557⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\E3B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3B5.tmp"
        558⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\E471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E471.tmp"
        559⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\E52C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E52C.tmp"
        560⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\E5D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5D8.tmp"
        561⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\E6A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6A3.tmp"
        562⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\E74F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E74F.tmp"
        563⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\E7FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7FB.tmp"
        564⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\E8C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8C6.tmp"
        565⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\E991.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E991.tmp"
        566⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\EA5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA5C.tmp"
        567⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\EB47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB47.tmp"
        568⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\EBD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBD3.tmp"
        569⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\EC7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC7F.tmp"
        570⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\ED5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED5A.tmp"
        571⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\EE35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE35.tmp"
        572⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\EED1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EED1.tmp"
        573⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\EF8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"
        574⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\F038.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F038.tmp"
        575⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\F113.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F113.tmp"
        576⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\F1CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1CF.tmp"
        577⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\F28A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F28A.tmp"
        578⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\F346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F346.tmp"
        579⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\F3F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3F2.tmp"
        580⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\F4AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4AD.tmp"
        581⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\F578.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F578.tmp"
        582⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\F634.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F634.tmp"
        583⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\F6FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6FF.tmp"
        584⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\F7CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7CA.tmp"
        585⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\F876.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F876.tmp"
        586⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\F931.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F931.tmp"
        587⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\F9FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9FC.tmp"
        588⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\FAB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAB8.tmp"
        589⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\FB73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB73.tmp"
        590⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\FC3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC3F.tmp"
        591⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\FCFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCFA.tmp"
        592⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\FDC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDC5.tmp"
        593⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\FE90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE90.tmp"
        594⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\FF4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF4C.tmp"
        595⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7.tmp"
        596⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3.tmp"
        597⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\16F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16F.tmp"
        598⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\22A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22A.tmp"
        599⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\2E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E6.tmp"
        600⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\392.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\392.tmp"
        601⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\47C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47C.tmp"
        602⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\547.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\547.tmp"
        603⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\603.tmp"
        604⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\6AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AE.tmp"
        605⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\75A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75A.tmp"
        606⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\825.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\825.tmp"
        607⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\8C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C2.tmp"
        608⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\97D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97D.tmp"
        609⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\A39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A39.tmp"
        610⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD5.tmp"
        611⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0.tmp"
        612⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\C3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3C.tmp"
        613⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\D17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17.tmp"
        614⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA4.tmp"
        615⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6F.tmp"
        616⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\F1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1B.tmp"
        617⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\FD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD6.tmp"
        618⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\1082.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1082.tmp"
        619⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\114D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\114D.tmp"
        620⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\1209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1209.tmp"
        621⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\12C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C4.tmp"
        622⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\1370.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1370.tmp"
        623⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\142C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\142C.tmp"
        624⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\14D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D7.tmp"
        625⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\1593.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1593.tmp"
        626⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\164E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\164E.tmp"
        627⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\171A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\171A.tmp"
        628⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\17B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B6.tmp"
        629⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\1871.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1871.tmp"
        630⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\190E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\190E.tmp"
        631⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\19E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19E8.tmp"
        632⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\1A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A85.tmp"
        633⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\1B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B50.tmp"
        634⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\1C0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C0B.tmp"
        635⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\1CB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CB7.tmp"
        636⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\1D82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D82.tmp"
        637⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\1E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E3E.tmp"
        638⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\1F09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F09.tmp"
        639⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\1FC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FC4.tmp"
        640⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\209F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\209F.tmp"
        641⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\215B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\215B.tmp"
        642⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\2206.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2206.tmp"
        643⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\22B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22B2.tmp"
        644⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\235E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\235E.tmp"
        645⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\240A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\240A.tmp"
        646⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\24B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24B6.tmp"
        647⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\2562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2562.tmp"
        648⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\260E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\260E.tmp"
        649⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\26C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26C9.tmp"
        650⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\2794.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2794.tmp"
        651⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\285F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\285F.tmp"
        652⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\28FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28FC.tmp"
        653⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\29C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29C7.tmp"
        654⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\2A82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A82.tmp"
        655⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\2B2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B2E.tmp"
        656⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\2BF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BF9.tmp"
        657⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\2CA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CA5.tmp"
        658⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\2D80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D80.tmp"
        659⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\2E4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E4B.tmp"
        660⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\2EE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EE7.tmp"
        661⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\2FB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FB2.tmp"
        662⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\305E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\305E.tmp"
        663⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\3129.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3129.tmp"
        664⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\3204.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3204.tmp"
        665⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\32B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32B0.tmp"
        666⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\336C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\336C.tmp"
        667⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\3408.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3408.tmp"
        668⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\34C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34C3.tmp"
        669⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\356F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\356F.tmp"
        670⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\362B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\362B.tmp"
        671⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\36D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36D7.tmp"
        672⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\3792.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3792.tmp"
        673⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\383E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\383E.tmp"
        674⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\3919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3919.tmp"
        675⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\39E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39E4.tmp"
        676⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\3AAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AAF.tmp"
        677⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\3B4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B4B.tmp"
        678⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\3C07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C07.tmp"
        679⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\3CC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"
        680⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\3D6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"
        681⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\3E58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E58.tmp"
        682⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\3F14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F14.tmp"
        683⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\3FCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FCF.tmp"
        684⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\406C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\406C.tmp"
        685⤵
        
        PID:6700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1251.tmp

Path C:\Users\Admin\AppData\Local\Temp\1251.tmp
Size 3.6MB
SHA256 d032b38c6f117ba8c18bacc0a7bf9d7400dfb8a3d9f65a9d99552607fae9a0e1
MD5 51d7d6a4fc6e5b3a6946311a3d9d5559
SHA1 548bf18c4b8b86fa8dd688a15c6537daa01cb222
SHA512 9a42259ed5d1d8dbdbfa10518e74c0c46efb1352c3f9f34bd3e8f34c0e2ea1b1b4ca0f68f965c16c05bed0b2d9af0cbe206f485d319cc09837cd117c840f2caa
SSDEEP 49152:w/OJDQcqjSNGEADt7i+/yTukuFGNLrkBirx:EOacqjSchrSiGdkBirx
TLSH
T1EE06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

151F.tmp

Path C:\Users\Admin\AppData\Local\Temp\151F.tmp
Size 3.6MB
SHA256 762758dbc107d5e1423781d604c0f710feae9f7132972b93b3d56d4531846409
MD5 e5e238b7cb2bc1bfa135615e2dd5c3b1
SHA1 22a58cf8e48f50a8ab4aff44b0484c40ff916862
SHA512 1fa74b3277bb893271b4787bcdcdc0fdcc690f942ae18b8259819b6c91701d599a6b5feeb81ef5b97ef1b12e5dab75b340bb07a9f91754d308240696393106af
SSDEEP 49152:w/OJDSkmuM1ZNGEADt7i+/yTukuFGNLrkBirx:EOx+chrSiGdkBirx
TLSH
T19906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\17B0.tmp
Size 3.6MB
SHA256 c0d6e6cef2e656337dac423c118952a0e16a849c25640d621979c6140796b1c0
MD5 ac822cf3acef0daf1f0a67469565f821
SHA1 179b8c7a97c25fe911370af0679142d8e8e55d4a
SHA512 f8d0aa549aeba194573d3a8af3b8aef8a14a78a7edfbc9037182b707339b4b2564891128cb3ba677c62957ba9b25caba8965c2f25b5da5b4348384662a316e55
SSDEEP 49152:w/OJDnBX5RNGEADt7i+/yTukuFGNLrkBirx:EO/XLchrSiGdkBirx
TLSH
T11406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A50.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A50.tmp
Size 3.6MB
SHA256 b385dfae6214fd7be99ca2c49da138d36ff6a7106d50484fee1a7bd7157e4f41
MD5 015a7acff6561915ad397b019595d972
SHA1 896d236d0fe45666a3a7382537b8baad274a92fc
SHA512 f10a0f32562eedbdc47f6626a058b1eef2c11bc0e239301acb54f7d477965ef27d7a1d840df49ae504b9217f792cb98f593770ffff4462b7152436720754b888
SSDEEP 49152:w/OJD7lEhi+rswNGEADt7i+/yTukuFGNLrkBirx:EOFlb+gwchrSiGdkBirx
TLSH
T16906831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1CD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CD0.tmp
Size 3.6MB
SHA256 473ae610c1e58c6a6f0d94caa72ed7014b4f6b33989c2f1bde6c7acd0e8d10ce
MD5 e7bf04a1dd5c502f532d2d84f27a7e95
SHA1 2cb9585818eec2cf153293c6eff8cefe1661751d
SHA512 88b12b0431dc476991ee2c646da3fd064557fd4c64462aed0dec69d0175f826b9f564e7a6b0e7b33d6da9403475e9ea6dfc8e295f62180fa74eafd6ce3723b89
SSDEEP 49152:w/OJD6yNGEADt7i+/yTukuFGNLrkBirx:EO4ychrSiGdkBirx
TLSH
T16506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

203B.tmp

Path C:\Users\Admin\AppData\Local\Temp\203B.tmp
Size 3.6MB
SHA256 a17285112c67ac4456bdddde5c840565a762397b21666a4cc30c1ec4bda7500c
MD5 4129a7c059d84531e62b18cbc598d346
SHA1 15bf43a8daefc56c064320ae829904391ad6d137
SHA512 c8ae690c365302194ebce46b6579bcb1e090405dca7de74d55324b3bf3328a2352cad929daf6cacb9332f3eddceddcf73ed6db504c6fad0d2b3b3a98b1b0330f
SSDEEP 49152:w/OJD0UdmNGEADt7i+/yTukuFGNLrkBirx:EOLdmchrSiGdkBirx
TLSH
T11106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2174.tmp

Path C:\Users\Admin\AppData\Local\Temp\2174.tmp
Size 3.6MB
SHA256 170c6c10323e6579998b56fb3f26292a379239587afd8c8da7f7435f71c6b310
MD5 30443317b3240ca4b6aff65d543481c2
SHA1 fc03b52dc939a104a236c5099fc045312f7cbea8
SHA512 4622dd17872565e1db355b17555de1e99c5abe48bf7c9dff5f772d7a32f2ebc53951886548deb52b4f8513d38ba8ac92beeb8b8855931a6a77cc8b1e3753615b
SSDEEP 49152:w/OJD0KRENWuNGEADt7i+/yTukuFGNLrkBirx:EOuKMchrSiGdkBirx
TLSH
T15506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2442.tmp

Path C:\Users\Admin\AppData\Local\Temp\2442.tmp
Size 3.6MB
SHA256 76199a6a2a96cbbecb5cc099e710388365fdf9669dc198a74ea6d27affc09baa
MD5 85507ca644802f218dfc784bb1bac674
SHA1 b646a39a024c975edb333dde449b28815f14067d
SHA512 b1b26a066034f9791a47e10d15d8851525c257069081d68ff1468d97e6e6128c454cc2bb48919e8e934136d396a4f3ee10285c9536c549d2fbc876b41fcca648
SSDEEP 49152:w/OJD0bhNGEADt7i+/yTukuFGNLrkBirx:EO2tchrSiGdkBirx
TLSH
T17606831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

279E.tmp

Path C:\Users\Admin\AppData\Local\Temp\279E.tmp
Size 3.6MB
SHA256 4aac4ded145d9b9e93c462f5c9a941649d7cddaae4e02464c2ebe6690db94a5d
MD5 2c3f064499d97e22a8566d72b2022865
SHA1 9b1952e375a7387ac3954d2a69b0f2addba98295
SHA512 09960569e96138ac5be4889654fc96e7cea3ee3c1fedcc1920aff03d137d529305fdc3b19e09563436fc337131bf5f0184b0b7b513df7b47a9b874691b72483d
SSDEEP 49152:w/OJDtmFJ4ve1NGEADt7i+/yTukuFGNLrkBirx:EO2X4m1chrSiGdkBirx
TLSH
T1B506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

291.tmp

Path C:\Users\Admin\AppData\Local\Temp\291.tmp
Size 3.6MB
SHA256 47e3fa15d9d8dcd311d5f8b8b4ed56a6593d0d075f2631269a6762145f5078d8
MD5 97afa8d3fa79486d5a77a47d7f1bb565
SHA1 a87c1effcef48ef436445026b1ef5adfe19ebc7d
SHA512 2f45bb4a262416fa092c7fb0e76794673d9e9b36d8a43ea1d01eaba15bc914abe6bfdae4637f0008516ba24df88524d466fddbcc7eb7bfb00539a9d1c2cbe7ba
SSDEEP 49152:w/OJDiYTdLOSNGEADt7i+/yTukuFGNLrkBirx:EOLLBchrSiGdkBirx
TLSH
T10B06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2A9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A9B.tmp
Size 3.6MB
SHA256 3ab9b1e0ea5bb48526a2b35b73ba7aca900cd4dd8c606e101682df6dd2c7e8b9
MD5 bc471bd8f58fc4d8a2f9a7f9abe03b69
SHA1 db60aaafd068259aae4cb67cc05f7387c8bad96b
SHA512 170b859c8693af63d017b599a5cace414bba18c9dc27085440b0162c6c506b334353459ecd9afe33a728dc2293cd4bd53d0be4fb2094b9651b1b77408dd9ccb0
SSDEEP 49152:w/OJDMHTAZuNGEADt7i+/yTukuFGNLrkBirx:EOc8ZuchrSiGdkBirx
TLSH
T1E006931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2DE7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2DE7.tmp
Size 3.6MB
SHA256 ca83dc43f3633bb6311827edb71821facefafbe061a5db43e2aa79ff8923eb22
MD5 78c386b4f23a92d9190c9a9fe371112d
SHA1 d520d9ac891738d3d191be0bdd649f67a7d939ad
SHA512 95c649f192ea13231ecee4d6ac1e77877ed7ce8b0a9349d320c7d19864a94c3bc80e7ff177506affbc032facd218be005a9137838c48f49e87678b14f31c15ba
SSDEEP 49152:w/OJDctj1aCNGEADt7i+/yTukuFGNLrkBirx:EOqtj1aCchrSiGdkBirx
TLSH
T13606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\30A6.tmp
Size 3.6MB
SHA256 2aebc9775783b0d50abcd92a1c948c32fe0394c433aaa58dadd6fa26dc026f50
MD5 ee2d9fb9e8ef7d1e18ccfa5099c66a1b
SHA1 5a16d1325eb080eb094646c4ac06d5d697fdd509
SHA512 1a767de946cbf36bdf6ab7a46d6f3ecf1261fce5137d59d8cdc47cb10f6fb206d198170310c065b1215d7c2f34c8b7469b9a59a47b407a0e54ba6ddae63f699d
SSDEEP 49152:w/OJDu2XiD2wNGEADt7i+/yTukuFGNLrkBirx:EO9X02wchrSiGdkBirx
TLSH
T19D06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

324C.tmp

Path C:\Users\Admin\AppData\Local\Temp\324C.tmp
Size 3.6MB
SHA256 e02195866e9f4b844eaf1861a6a41739bb6cf5ffca24398797d56ba13a775bca
MD5 769b809ad02a7013c694134d4dc3609f
SHA1 6c391ef3815c501ba9b1f9dead8f9745bf6b0ed9
SHA512 d022e11c4c0b22fa3f566ebb9cb4a894f81965fe903a76ae82d472386966c055c70a4de0ce05be9e48910e9cec765bf08452071b3fdc05502de3ec6e9c6cbd29
SSDEEP 49152:w/OJD/ri7F3tCNGEADt7i+/yTukuFGNLrkBirx:EOdriZ0chrSiGdkBirx
TLSH
T12A06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

351B.tmp

Path C:\Users\Admin\AppData\Local\Temp\351B.tmp
Size 3.6MB
SHA256 6d7d6ef82495f09c403d38c7b786e47f774ecef7f956bef5be2f70eb03c91c48
MD5 fc6d0320e9a8f4ea5f7f76b78ba980d5
SHA1 3075b30dfc61e28c6496cd12caee3f51f6e4d020
SHA512 32a04669f77166e230b8a1615cc4ef5d829ccf60d74192c070c5ddc22bbcb24ad079cd6a445adb5c4e458a0abdbe283e25760edbc132077073d4bf4fb6a2a6e2
SSDEEP 49152:w/OJD8EWoSNGEADt7i+/yTukuFGNLrkBirx:EORechrSiGdkBirx
TLSH
T18706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37C.tmp

Path C:\Users\Admin\AppData\Local\Temp\37C.tmp
Size 3.6MB
SHA256 f380ad0950c1664ef368cd5c48a2acd52a811d32e8821407c51b9b17ad9efdd2
MD5 9c322ebbb9faf5045dd3401b96757ca6
SHA1 c6f896757f227a310ea81420a86dc547a7c486dd
SHA512 64c69ac886352ae7a879c8021c991e87ce34fe0ae01d03f9c26490c185fb9fb62a39ac8e51c97c4a9168fb5f60499cfafe4fa658b873c32c6fe4f15bded77d68
SSDEEP 49152:w/OJDNbQVj/W5NGEADt7i+/yTukuFGNLrkBirx:EObbuLW5chrSiGdkBirx
TLSH
T12C06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3847.tmp

Path C:\Users\Admin\AppData\Local\Temp\3847.tmp
Size 3.6MB
SHA256 bb7a8395af6fe24ab33a38be5b8876d992d409f5f3dba0dfdbcde804fd1caf5f
MD5 ad74c97ef83acf8882ca4ee615d68ac9
SHA1 d20b95eaada0bf05f9865bbc10eba130fe271d7b
SHA512 2ba7374ad33e62d77f7f5ce953b04f5109f7cbefea6151ecfae164d1a2f2a2b97559add50a5dba9a849c0133d8ad55bec7e113d109ae103ba127da89ab4f75ce
SSDEEP 49152:w/OJDTKxJJNGEADt7i+/yTukuFGNLrkBirx:EO8chrSiGdkBirx
TLSH
T13C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B07.tmp
Size 3.6MB
SHA256 7907adb4ad76538ac753538d282d6aa6a5a0f3404c7ae8353c24690c1a938416
MD5 b377e93c75844aea7aae0cd9ae52e3bc
SHA1 1dac290922c99ef9626a181a48d7301421030193
SHA512 2bd09b1d90ed129e2d9d5c6043659e4c4cc0277c0744914807b7a2ad008f91422a5bb6a131d12e0d192eabe2bfe27fcd2fe8a551cdf8444172bc22b1dbd1f097
SSDEEP 49152:w/OJDOqUu297NGEADt7i+/yTukuFGNLrkBirx:EO707chrSiGdkBirx
TLSH
T13F06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3D97.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D97.tmp
Size 3.6MB
SHA256 1a7c8c1bc9bd177a938b38f0e0f82c1508643b86b9e0ab70f8ebe760a46abd08
MD5 dbe078f37e895f1a9a813b3d20f73346
SHA1 ac346849d8b98932771ed3c61b8a5aceb2b8c3e9
SHA512 c43ac41b66077fda9c9cc65723ff6356bb3b70f8aa8278a6332efa54ff81bdcb3b6271992d9e3624db0feed74be656bf3da45960ca75e5ba20ecb7b4a84870af
SSDEEP 49152:w/OJDQ0vU2NGEADt7i+/yTukuFGNLrkBirx:EO5vU2chrSiGdkBirx
TLSH
T1F606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4046.tmp

Path C:\Users\Admin\AppData\Local\Temp\4046.tmp
Size 3.6MB
SHA256 ef47cb6faa15a2104148d1c13735d0e6f5f0bb856937b6d3663dde1d3f5eed92
MD5 eed5ad8d752a7febbba922674af423fc
SHA1 ec34de8db7a16c32bc0b5934d2623149e5e2e5ba
SHA512 c39e67db0f1648fdd0b68e4fce2bb107e5f3c26bd27daea64eabf803a15f4396225168c031f859fa79b34d9c3c51103f76cd5eb15100ff563bad2a3b73bc52fb
SSDEEP 49152:w/OJDJcNGEADt7i+/yTukuFGNLrkBirx:EOMchrSiGdkBirx
TLSH
T12E06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4325.tmp

Path C:\Users\Admin\AppData\Local\Temp\4325.tmp
Size 3.6MB
SHA256 bede2679346d9116a0b48af9ee20af38044eaf42c418a7a41ce5d22827ea4fa9
MD5 2acd44a7b8fc8adcb66caf8db86ff460
SHA1 27ed0c00fb74f6dbcf38455c827e1f7e2837d144
SHA512 48f5f616a57e6c957e192f7001d6fda5887dbf8b33171b2124817cd920aff33f260112000aeb695078eae0a5e5ebe6302e1931b8d25f4277c4582158bea5441e
SSDEEP 49152:w/OJDr4t1dX7x4iNGEADt7i+/yTukuFGNLrkBirx:EONuLx9chrSiGdkBirx
TLSH
T1FD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\45C5.tmp
Size 3.6MB
SHA256 22fcb51828c942b476da2b08973ce39f6b89f8802bc3d7059b1b43b7f421446d
MD5 98bdb6ccd49bc3bd658d1f08036e6b9b
SHA1 04b2808d4d2b638a0bedc6c20030dad7e1c1d411
SHA512 d52c72ffcd264d484da3e71e8da6265ab1bb5fb8ad71c1fcd64f081dfd36c54f465d6ce1cddc136a770975199f3143739c9a1db105cc6216470d76c4162ce380
SSDEEP 49152:w/OJDXLBmmyNGEADt7i+/yTukuFGNLrkBirx:EOhgmychrSiGdkBirx
TLSH
T1BC06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4910.tmp

Path C:\Users\Admin\AppData\Local\Temp\4910.tmp
Size 3.6MB
SHA256 a45febc253db7cb75ec2cd6ed741d5c56edc0016466849fc5d9b430dc8789d7a
MD5 57c7e6adbcaf6bc7b589aedaa0ba9591
SHA1 ff81805739340706983ecde5310b6146696a09fa
SHA512 2d42d4e6a071f509ab614cd0550c5ad3974d9bd951a2f056f521e11dc10766d32354950aa5e608a3662d758f92842a1bb59438bb41921e3141e30b8d741eb496
SSDEEP 49152:w/OJDpNd1GC7NGEADt7i+/yTukuFGNLrkBirx:EOjNnGechrSiGdkBirx
TLSH
T1F506931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4BA1.tmp
Size 3.6MB
SHA256 9d038b1e93b17af27126ffe1a0d75ce1f02d1fa7935ac7e74f17451539ed98fe
MD5 e0b5dd00f846c3059b766eab637ac795
SHA1 ba42d44c51df89d2d4acac0a3de907323ab2c8b4
SHA512 15ab9274cbe50d194a501a204e1238e1ace7d77adc84edf732eea349d5d83b19f5a854c73b7d2fa857fc80a3bb82d9d207241e73696283afcf4f4eeca849baa1
SSDEEP 49152:w/OJDCpY37SZmYNGEADt7i+/yTukuFGNLrkBirx:EOH2chrSiGdkBirx
TLSH
T1E406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B2.tmp
Size 3.6MB
SHA256 a47e125760f02599120d2ad205fc9e442d7e28ac2f5e406eacf81c5e05738409
MD5 1cab13afb2bc50bb0973206a6df77ba0
SHA1 3100fd236dfd7886d31da0d7bbf0c5db1b683cf0
SHA512 51e3993142a45ce0a3afee8ef9fa3c8c670a85d18e48fc7bf031c41ebb7d25a2e329954e99ac4dbaeab4e2ad3b2742caaad361191af23eef610f0eb08cadf232
SSDEEP 49152:w/OJD4oe/lGNGEADt7i+/yTukuFGNLrkBirx:EO3SlGchrSiGdkBirx
TLSH
T1FD06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A61.tmp

Path C:\Users\Admin\AppData\Local\Temp\A61.tmp
Size 3.6MB
SHA256 a30bf914dcfeb60915fe727131bb6d4f5631bee51c4ec7ee98f6dfe04d13b2cb
MD5 22995449601195e79d6c773b537457d3
SHA1 673acfae2779d03b985d468ca00f2f89d5252f39
SHA512 fe6cb09f98a19f7ad400b82510570b9c6a7d903337a127cc77902c1addca7241c820c3c0e171c7270bb7405728ba2574fc8bf963c41ac989b65037fd81eefd50
SSDEEP 49152:w/OJDIRPNGEADt7i+/yTukuFGNLrkBirx:EOqRPchrSiGdkBirx
TLSH
T16406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\CE2.tmp
Size 3.6MB
SHA256 67c0d018ea46c605a0e5aa0296f1221f0977701fa7e2e590816492a9359bb2e5
MD5 2fef0f873731758c7745ac4dc0c49d1f
SHA1 6bad4ac0b832ddc5777687b7e3ca8997d42e10d7
SHA512 8948ab93df14234ccca288df9a8a972f5523ec1cf888ae97eb07c1fdaa4d963bcd1b0fc16d8f2be23b54c33868bee4b72645ced3240cc73b13a4868e471cd69d
SSDEEP 49152:w/OJDZepTfHNGEADt7i+/yTukuFGNLrkBirx:EOrAfHchrSiGdkBirx
TLSH
T17F06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F7B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\F7B4.tmp
Size 3.6MB
SHA256 0205e908ca9cc0b25cea6876c14c13ab2c8c2238d45377640434d8c59ee1165c
MD5 c74e07a64a23af0671a0222555b3dcd5
SHA1 424b8ddc4ced3bc37ea9fd3a92390925d61eff4f
SHA512 ec6e56474be20e124ed566e591518edc0e182e223766c5e0e2a9aa939be0d3dd2278f9db7098e28729463eb9fd1a1dcb5a11b86c1a8db812091d6a0509078960
SSDEEP 49152:w/OJDGqJQsnQ3NGEADt7i+/yTukuFGNLrkBirx:EOIqQ3chrSiGdkBirx
TLSH
T13F06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F87F.tmp

Path C:\Users\Admin\AppData\Local\Temp\F87F.tmp
Size 3.6MB
SHA256 a0917dbb3dd7774b0f3b93c933f367fd93f8ac72852ef8fcc7aecbdba2ba8257
MD5 7432fe888c872926593345622545a004
SHA1 b1274b3a973bcea05778c4db275fe41faf68fd33
SHA512 681cc61acfe8e6e7b5b798d4bbcbb0039c6a58971e4ac5d27c123cc12e19f06e2ab8a58ae287cbc106a4529a7179c11af4c53dd6dae7f50751b1b092487c6129
SSDEEP 49152:w/OJDBJ8NGEADt7i+/yTukuFGNLrkBirx:EOechrSiGdkBirx
TLSH
T1E806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB1.tmp
Size 3.6MB
SHA256 950ef841ea6af83f2e896929e16610ce689fc1249d98bbbf77c25e10141d76cf
MD5 8fd41a8b037ba6cc1e5a2e87b7d18b4d
SHA1 2929f7dce70e12fadea025c4095db85e4cf3c2a6
SHA512 3851d878f7fa1f8c804bd3a32e2a72dde1507b4842b5cc0c4b6f566774309971332dd651b3c69c519d3ab31bd396e28a2f83ba240498f78ab5ccf57e5158ca8e
SSDEEP 49152:w/OJDfaqmNGEADt7i+/yTukuFGNLrkBirx:EO85chrSiGdkBirx
TLSH
T15206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FC87.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC87.tmp
Size 3.6MB
SHA256 9d2d8b27f55d87c3fcd4218931d62a32183c87daf44c541b274129733b2d5ed9
MD5 a17794399969c5e3d2803fbc71818423
SHA1 c36b4800064f7bb7d10b301c8146c5f81a5340d6
SHA512 8a5244d793a660aa4cb8814b32f0f0d303e8d5fd219c8281d43b466e7d3de52117af28e350180933effc7cd5e60e1269998b9cd662c23c65e4c2e5efc893a8c2
SSDEEP 49152:w/OJDvM8o2XUNGEADt7i+/yTukuFGNLrkBirx:EOiIkchrSiGdkBirx
TLSH
T11D06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FDCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDCF.tmp
Size 3.6MB
SHA256 4d0d52e07a95f5e80d3ea7b23fcf921826f97266ffcc25e098daf27377909294
MD5 a51aecc158fcbdf1df5c559e29abf0e9
SHA1 a7d8497ffb13edae73e68cbd68b9b56a613044e5
SHA512 7993d3b321713c0dcce38bb8a6377d5b25d4b88e853991950c495d2611bd899b48bc4bd946aa52219920aa5d3fc12b41843fe6d5265d53ca7736747818c62e0e
SSDEEP 49152:w/OJDharGPBNGEADt7i+/yTukuFGNLrkBirx:EO/JchrSiGdkBirx
TLSH
T1CE06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-288-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/120-294-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/344-284-0x0000000000620000-0x00000000006A3000-memory.dmp

Download

memory/344-289-0x0000000000620000-0x00000000006A3000-memory.dmp

Download

memory/368-68-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/368-61-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/424-103-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/424-110-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/480-298-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/756-0-0x0000000000F30000-0x0000000000FB3000-memory.dmp

Download

memory/756-6-0x0000000000F30000-0x0000000000FB3000-memory.dmp

Download

memory/960-208-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/960-201-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/992-138-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/992-132-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/1092-48-0x00000000004F0000-0x0000000000573000-memory.dmp

Download

memory/1092-42-0x00000000004F0000-0x0000000000573000-memory.dmp

Download

memory/1100-299-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/1100-293-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/1148-233-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/1148-239-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/1256-268-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1256-274-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1444-249-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/1444-254-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/1544-180-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/1544-188-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/1696-160-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/1696-152-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/1856-258-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/1856-264-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/1928-253-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/1928-259-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/2288-283-0x0000000000560000-0x00000000005E3000-memory.dmp

Download

memory/2288-278-0x0000000000560000-0x00000000005E3000-memory.dmp

Download

memory/2308-34-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/2308-27-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/2484-223-0x0000000000580000-0x0000000000603000-memory.dmp

Download

memory/2484-215-0x0000000000580000-0x0000000000603000-memory.dmp

Download

memory/2672-125-0x0000000000DE0000-0x0000000000E63000-memory.dmp

Download

memory/2672-131-0x0000000000DE0000-0x0000000000E63000-memory.dmp

Download

memory/2768-146-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/2768-139-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/2936-90-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/2936-82-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/3064-243-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/3064-248-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/3392-273-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/3392-279-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/3468-187-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/3468-195-0x00000000001B0000-0x0000000000233000-memory.dmp

Download

memory/3568-105-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/3568-97-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/3588-21-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3588-12-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3988-19-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/3988-26-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/4236-194-0x0000000000D70000-0x0000000000DF3000-memory.dmp

Download

memory/4236-202-0x0000000000D70000-0x0000000000DF3000-memory.dmp

Download

memory/4244-175-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/4244-166-0x0000000000C70000-0x0000000000CF3000-memory.dmp

Download

memory/4332-303-0x0000000000340000-0x00000000003C3000-memory.dmp

Download

memory/4360-222-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/4360-229-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/4368-62-0x0000000000E70000-0x0000000000EF3000-memory.dmp

Download

memory/4368-55-0x0000000000E70000-0x0000000000EF3000-memory.dmp

Download

memory/4540-89-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/4540-96-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/4580-83-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/4580-76-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/4660-33-0x00000000008A0000-0x0000000000923000-memory.dmp

Download

memory/4660-41-0x00000000008A0000-0x0000000000923000-memory.dmp

Download

memory/4684-14-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/4684-5-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/4704-75-0x0000000000330000-0x00000000003B3000-memory.dmp

Download

memory/4704-69-0x0000000000330000-0x00000000003B3000-memory.dmp

Download

memory/4756-153-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/4756-145-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/4812-118-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/4812-124-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/4956-244-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/4956-238-0x00000000006C0000-0x0000000000743000-memory.dmp

Download

memory/4976-263-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/4976-269-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/5336-54-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/5336-47-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/5392-111-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/5392-117-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/5492-217-0x0000000000760000-0x00000000007E3000-memory.dmp

Download

memory/5492-209-0x0000000000760000-0x00000000007E3000-memory.dmp

Download

memory/5652-159-0x0000000000630000-0x00000000006B3000-memory.dmp

Download

memory/5652-168-0x0000000000630000-0x00000000006B3000-memory.dmp

Download

memory/5780-173-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/5780-182-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/6076-234-0x0000000000520000-0x00000000005A3000-memory.dmp

Download

memory/6076-228-0x0000000000520000-0x00000000005A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads