2006098c3920b46517be6f2c18336fbdbcadc88fd9a1b6234065a0e52e6101c5

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_43fe4e6c5818583c3febf6f9d665c69f_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260804-tfleaahr2x
SHA256 2006098c3920b46517be6f2c18336fbdbcadc88fd9a1b6234065a0e52e6101c5
MD5 43fe4e6c5818583c3febf6f9d665c69f
SHA1 f6e8869a5b49bdc155a52559810162e3ef9d27a1
SHA512 8d83837f5faab54c5189d7aac456f1e7b4bbca7cd839f9acbf1c21415660face802e0aa93cbab5142516dd4a450f6e62ac275b2a479596d7f02db696ead5d4cf
SSDEEP 49152:w/OJDbyH2c3NGEADt7i+/yTukuFGNLrkBirx:EOxe2qchrSiGdkBirx
TLSH
T1C806831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4312	484A.tmp
5036	49FF.tmp
4124	4E07.tmp
3136	4EF1.tmp
4900	53E3.tmp
2860	572E.tmp
3852	5A1C.tmp
2388	5B07.tmp
3096	5EEF.tmp
252	621B.tmp
1184	6548.tmp
4628	68A3.tmp
3012	6BA1.tmp
1756	6F0C.tmp
5012	7238.tmp
5700	74A9.tmp
5604	7843.tmp
1148	7B8F.tmp
3056	7D25.tmp
1248	8284.tmp
1716	862E.tmp
4400	890C.tmp
3936	8C0A.tmp
1916	9021.tmp
4624	934D.tmp
2096	961C.tmp
5744	9939.tmp
2756	9C65.tmp
3680	9F44.tmp
3792	A2BE.tmp
4184	A5BC.tmp
1056	A917.tmp
2512	AC24.tmp
2424	AD3E.tmp
3604	AE47.tmp
4980	AF41.tmp
5380	B00C.tmp
4472	B0E7.tmp
1544	B1E1.tmp
5672	B2EB.tmp
4836	B414.tmp
1228	B51D.tmp
4724	B646.tmp
5784	B702.tmp
4068	B869.tmp
1960	B963.tmp
4996	BA5D.tmp
5796	BB09.tmp
4788	BBF3.tmp
4192	BCBE.tmp
2448	BD6A.tmp
5524	BE35.tmp
4232	BF10.tmp
3828	BFEB.tmp
2516	C0A6.tmp
1392	C162.tmp
236	C22D.tmp
5748	C2E9.tmp
2488	C3C3.tmp
3172	C460.tmp
1196	C55A.tmp
2776	C673.tmp
5976	C72E.tmp
4280	C7EA.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51BB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7938.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5715.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6F0C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B869.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBC2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EE6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32F8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F667.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	215F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4310.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C72E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D9BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB5E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	449C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	689E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80E9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED7E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F67.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D9B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFAA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8847.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DA6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EBFC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A402.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9F2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FF31.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6127.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE35.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C162.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	963.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6202.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C62.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F9C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC24.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F756.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7214.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2910.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B97.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A5BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ABD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86F4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63B8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1639.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4EE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24EA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CA8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5824.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	619A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75DD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87DE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E291.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A1E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AD5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	934D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40A4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D20.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEC8.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4312	4912	2026-08-04_43fe4e6c5818583c3febf6f9d665c69f_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4312 wrote to memory of 5036	4312	484A.tmp	90
PID 5036 wrote to memory of 4124	5036	49FF.tmp	91
PID 4124 wrote to memory of 3136	4124	4E07.tmp	92
PID 3136 wrote to memory of 4900	3136	4EF1.tmp	93
PID 4900 wrote to memory of 2860	4900	53E3.tmp	94
PID 2860 wrote to memory of 3852	2860	572E.tmp	95
PID 3852 wrote to memory of 2388	3852	5A1C.tmp	96
PID 2388 wrote to memory of 3096	2388	5B07.tmp	97
PID 3096 wrote to memory of 252	3096	5EEF.tmp	98
PID 252 wrote to memory of 1184	252	621B.tmp	99
PID 1184 wrote to memory of 4628	1184	6548.tmp	100
PID 4628 wrote to memory of 3012	4628	68A3.tmp	101
PID 3012 wrote to memory of 1756	3012	6BA1.tmp	102
PID 1756 wrote to memory of 5012	1756	6F0C.tmp	103
PID 5012 wrote to memory of 5700	5012	7238.tmp	104
PID 5700 wrote to memory of 5604	5700	74A9.tmp	105
PID 5604 wrote to memory of 1148	5604	7843.tmp	106
PID 1148 wrote to memory of 3056	1148	7B8F.tmp	107
PID 3056 wrote to memory of 1248	3056	7D25.tmp	108
PID 1248 wrote to memory of 1716	1248	8284.tmp	109
PID 1716 wrote to memory of 4400	1716	862E.tmp	110
PID 4400 wrote to memory of 3936	4400	890C.tmp	111
PID 3936 wrote to memory of 1916	3936	8C0A.tmp	112
PID 1916 wrote to memory of 4624	1916	9021.tmp	113
PID 4624 wrote to memory of 2096	4624	934D.tmp	114
PID 2096 wrote to memory of 5744	2096	961C.tmp	115
PID 5744 wrote to memory of 2756	5744	9939.tmp	116
PID 2756 wrote to memory of 3680	2756	9C65.tmp	117
PID 3680 wrote to memory of 3792	3680	9F44.tmp	118
PID 3792 wrote to memory of 4184	3792	A2BE.tmp	119
PID 4184 wrote to memory of 1056	4184	A5BC.tmp	120
PID 1056 wrote to memory of 2512	1056	A917.tmp	121
PID 2512 wrote to memory of 2424	2512	AC24.tmp	122
PID 2424 wrote to memory of 3604	2424	AD3E.tmp	123
PID 3604 wrote to memory of 4980	3604	AE47.tmp	124
PID 4980 wrote to memory of 5380	4980	AF41.tmp	125
PID 5380 wrote to memory of 4472	5380	B00C.tmp	126
PID 4472 wrote to memory of 1544	4472	B0E7.tmp	127
PID 1544 wrote to memory of 5672	1544	B1E1.tmp	128
PID 5672 wrote to memory of 4836	5672	B2EB.tmp	129
PID 4836 wrote to memory of 1228	4836	B414.tmp	130
PID 1228 wrote to memory of 4724	1228	B51D.tmp	131
PID 4724 wrote to memory of 5784	4724	B646.tmp	132
PID 5784 wrote to memory of 4068	5784	B702.tmp	133
PID 4068 wrote to memory of 1960	4068	B869.tmp	134
PID 1960 wrote to memory of 4996	1960	B963.tmp	135
PID 4996 wrote to memory of 5796	4996	BA5D.tmp	136
PID 5796 wrote to memory of 4788	5796	BB09.tmp	138
PID 4788 wrote to memory of 4192	4788	BBF3.tmp	139
PID 4192 wrote to memory of 2448	4192	BCBE.tmp	140
PID 2448 wrote to memory of 5524	2448	BD6A.tmp	141
PID 5524 wrote to memory of 4232	5524	BE35.tmp	142
PID 4232 wrote to memory of 3828	4232	BF10.tmp	143
PID 3828 wrote to memory of 2516	3828	BFEB.tmp	144
PID 2516 wrote to memory of 1392	2516	C0A6.tmp	145
PID 1392 wrote to memory of 236	1392	C162.tmp	146
PID 236 wrote to memory of 5748	236	C22D.tmp	147
PID 5748 wrote to memory of 2488	5748	C2E9.tmp	148
PID 2488 wrote to memory of 3172	2488	C3C3.tmp	149
PID 3172 wrote to memory of 1196	3172	C460.tmp	150
PID 1196 wrote to memory of 2776	1196	C55A.tmp	151
PID 2776 wrote to memory of 5976	2776	C673.tmp	152
PID 5976 wrote to memory of 4280	5976	C72E.tmp	153

C:\Users\Admin\AppData\Local\Temp\2026-08-04_43fe4e6c5818583c3febf6f9d665c69f_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_43fe4e6c5818583c3febf6f9d665c69f_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\484A.tmp
  "C:\Users\Admin\AppData\Local\Temp\484A.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\49FF.tmp
    "C:\Users\Admin\AppData\Local\Temp\49FF.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\4E07.tmp
      "C:\Users\Admin\AppData\Local\Temp\4E07.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\4EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\53E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53E3.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\572E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\572E.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\5A1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\5B07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B07.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\5EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\621B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\621B.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\6548.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6548.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\68A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68A3.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\6BA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\6F0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\7238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7238.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\74A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74A9.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\7843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7843.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\7B8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\7D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D25.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\8284.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8284.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\862E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\862E.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\890C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\890C.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\8C0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\9021.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9021.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\934D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\934D.tmp"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\961C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\961C.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\9939.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9939.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\9C65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C65.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\9F44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F44.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\A2BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\A5BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\A917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A917.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\AC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC24.tmp"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\AD3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\AE47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE47.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\AF41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF41.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\B00C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B00C.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\B0E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\B1E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\B2EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\B414.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B414.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\B51D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B51D.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\B646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B646.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\B702.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B702.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\B869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B869.tmp"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\B963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B963.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\BA5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\BB09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB09.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\BBF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\BCBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\BD6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\BE35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE35.tmp"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\BF10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF10.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\BFEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\C0A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\C162.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C162.tmp"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\C22D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C22D.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\C2E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\C3C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\C460.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C460.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\C55A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C55A.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\C673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C673.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\C72E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C72E.tmp"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\C7EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"
        65⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\C903.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C903.tmp"
        66⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\C9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"
        67⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\CAE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"
        68⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\CBC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\CC6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"
        70⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\CD58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD58.tmp"
        71⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\CE33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE33.tmp"
        72⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\CEDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"
        73⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\CFAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"
        74⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\D056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D056.tmp"
        75⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\D112.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D112.tmp"
        76⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\D24A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D24A.tmp"
        77⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\D2F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"
        78⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\D3C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"
        79⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\D48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D48C.tmp"
        80⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\D538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D538.tmp"
        81⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\D603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D603.tmp"
        82⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\D6EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"
        83⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\D807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D807.tmp"
        84⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\D8E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"
        85⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\D9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\DA78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA78.tmp"
        87⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\DB43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB43.tmp"
        88⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\DBEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"
        89⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\DCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"
        90⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\DD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD56.tmp"
        91⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\DE02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE02.tmp"
        92⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\DECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DECD.tmp"
        93⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\DF79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF79.tmp"
        94⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\E044.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E044.tmp"
        95⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\E100.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E100.tmp"
        96⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\E1EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"
        97⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\E296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E296.tmp"
        98⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\E390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E390.tmp"
        99⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\E43C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E43C.tmp"
        100⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\E517.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E517.tmp"
        101⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\E5D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"
        102⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\E69D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E69D.tmp"
        103⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\E768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E768.tmp"
        104⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\E833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E833.tmp"
        105⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\E8FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"
        106⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\E9BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"
        107⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\EA85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA85.tmp"
        108⤵
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\EB60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB60.tmp"
        109⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\EBFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\ECC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"
        111⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\ED73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED73.tmp"
        112⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\EE3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"
        113⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\EEFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"
        114⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\EFC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"
        115⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\F090.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F090.tmp"
        116⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\F13C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F13C.tmp"
        117⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\F236.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F236.tmp"
        118⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\F2D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"
        119⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\F39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F39D.tmp"
        120⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\F468.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F468.tmp"
        121⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\F524.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F524.tmp"
        122⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\F5DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"
        123⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\F69B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F69B.tmp"
        124⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\F756.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F756.tmp"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\F822.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F822.tmp"
        126⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\F90C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F90C.tmp"
        127⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\F9E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"
        128⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\FAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"
        129⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\FB5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\FC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC29.tmp"
        131⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\FCE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"
        132⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\FDAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"
        133⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\FE7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"
        134⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\FF36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF36.tmp"
        135⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1.tmp"
        136⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC.tmp"
        137⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\178.tmp"
        138⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\234.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\234.tmp"
        139⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\2E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E0.tmp"
        140⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\3AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AB.tmp"
        141⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\466.tmp"
        142⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\531.tmp"
        143⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\5FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FC.tmp"
        144⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\6A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A8.tmp"
        145⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\764.tmp"
        146⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\81F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81F.tmp"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\8FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FA.tmp"
        148⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\996.tmp"
        149⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A52.tmp"
        150⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\B1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1D.tmp"
        151⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\BD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD8.tmp"
        152⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\CA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA4.tmp"
        153⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F.tmp"
        154⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\E2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2A.tmp"
        155⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE6.tmp"
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\F92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F92.tmp"
        157⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\104D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\104D.tmp"
        158⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\1109.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1109.tmp"
        159⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\11B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11B4.tmp"
        160⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\1270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1270.tmp"
        161⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\133B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\133B.tmp"
        162⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\1416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1416.tmp"
        163⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\14C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14C2.tmp"
        164⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\156E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\156E.tmp"
        165⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\1639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1639.tmp"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\16E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16E5.tmp"
        167⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\17A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17A0.tmp"
        168⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\185C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\185C.tmp"
        169⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\1917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1917.tmp"
        170⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\19F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19F2.tmp"
        171⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\1ABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\1B69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B69.tmp"
        173⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\1C15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C15.tmp"
        174⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\1CC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"
        175⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\1D9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\1E47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E47.tmp"
        177⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\1F12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F12.tmp"
        178⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\1FBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"
        179⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\205A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\205A.tmp"
        180⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\2126.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2126.tmp"
        181⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\21E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21E1.tmp"
        182⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\22AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22AC.tmp"
        183⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\2358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2358.tmp"
        184⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\2414.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2414.tmp"
        185⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\24CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24CF.tmp"
        186⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\258B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\258B.tmp"
        187⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\2665.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2665.tmp"
        188⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\2702.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2702.tmp"
        189⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\27CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27CD.tmp"
        190⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\2898.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2898.tmp"
        191⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\2953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2953.tmp"
        192⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\2A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"
        193⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\2ADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"
        194⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\2B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B86.tmp"
        195⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\2C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C51.tmp"
        196⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\2D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"
        197⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\2DC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"
        198⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\2E83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E83.tmp"
        199⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\2F4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"
        200⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\300A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\300A.tmp"
        201⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\30C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30C6.tmp"
        202⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\3171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3171.tmp"
        203⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\322D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\322D.tmp"
        204⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\32F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F8.tmp"
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\33B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33B4.tmp"
        206⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\347F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\347F.tmp"
        207⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\352B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\352B.tmp"
        208⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\35D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35D6.tmp"
        209⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\3692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3692.tmp"
        210⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\375D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\375D.tmp"
        211⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\3809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3809.tmp"
        212⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\38C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38C4.tmp"
        213⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\3970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3970.tmp"
        214⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\3A2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"
        215⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\3AD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"
        216⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\3B74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B74.tmp"
        217⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\3C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"
        218⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\3CDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"
        219⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\3D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D97.tmp"
        220⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\3E72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E72.tmp"
        221⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\3F1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"
        222⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\4008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4008.tmp"
        223⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\40A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40A4.tmp"
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\417F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417F.tmp"
        225⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\423A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\423A.tmp"
        226⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\42F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42F6.tmp"
        227⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\43E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43E0.tmp"
        228⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\449C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\449C.tmp"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\4567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4567.tmp"
        230⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\4603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4603.tmp"
        231⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\4690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4690.tmp"
        232⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\476A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\476A.tmp"
        233⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\4826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4826.tmp"
        234⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\48F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48F1.tmp"
        235⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\498D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\498D.tmp"
        236⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\4A49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A49.tmp"
        237⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\4B04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B04.tmp"
        238⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\4BC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"
        239⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\4C7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"
        240⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\4D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D37.tmp"
        241⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\4E02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E02.tmp"
        242⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\4EAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"
        243⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\4F5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F5A.tmp"
        244⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\5015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5015.tmp"
        245⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\50E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50E0.tmp"
        246⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\51BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51BB.tmp"
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\5267.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5267.tmp"
        248⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\5322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5322.tmp"
        249⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\53DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53DE.tmp"
        250⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\548A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\548A.tmp"
        251⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\5536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5536.tmp"
        252⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\55D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55D2.tmp"
        253⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\569D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\569D.tmp"
        254⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\5759.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5759.tmp"
        255⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\5824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5824.tmp"
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\58D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58D0.tmp"
        257⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\59D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59D9.tmp"
        258⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\5A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A85.tmp"
        259⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\5B60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B60.tmp"
        260⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\5C0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"
        261⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\5CD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CD7.tmp"
        262⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\5D83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D83.tmp"
        263⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\5E2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"
        264⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\5F19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F19.tmp"
        265⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\5FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"
        266⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\60A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60A0.tmp"
        267⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\619A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\619A.tmp"
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\6274.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6274.tmp"
        269⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\6330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6330.tmp"
        270⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\63EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63EB.tmp"
        271⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\64A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64A7.tmp"
        272⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\6572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6572.tmp"
        273⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\664D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\664D.tmp"
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\6708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6708.tmp"
        275⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\67E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67E3.tmp"
        276⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\689E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\689E.tmp"
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\6998.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6998.tmp"
        278⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\6A54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A54.tmp"
        279⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\6B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B00.tmp"
        280⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\6BDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"
        281⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\6C96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C96.tmp"
        282⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\6D52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D52.tmp"
        283⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\6E0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E0D.tmp"
        284⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\6ED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"
        285⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\6FC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"
        286⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\708E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\708E.tmp"
        287⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\713A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\713A.tmp"
        288⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\7214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7214.tmp"
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\72DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72DF.tmp"
        290⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\738B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\738B.tmp"
        291⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\7437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7437.tmp"
        292⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\7502.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7502.tmp"
        293⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\75DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75DD.tmp"
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\76A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76A8.tmp"
        295⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\7793.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7793.tmp"
        296⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\785E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\785E.tmp"
        297⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\7938.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7938.tmp"
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\7A13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A13.tmp"
        299⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\7ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"
        300⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\7B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"
        301⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\7C46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C46.tmp"
        302⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\7D20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D20.tmp"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\7DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"
        304⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\7EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"
        305⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\7F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F63.tmp"
        306⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\804D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\804D.tmp"
        307⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\80E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80E9.tmp"
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\81C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81C4.tmp"
        309⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\828F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\828F.tmp"
        310⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\835A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\835A.tmp"
        311⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\8416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8416.tmp"
        312⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\84D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84D1.tmp"
        313⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\859C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\859C.tmp"
        314⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\8639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8639.tmp"
        315⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\86F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86F4.tmp"
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\87DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87DE.tmp"
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\88AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88AA.tmp"
        318⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\8965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8965.tmp"
        319⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\8A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A30.tmp"
        320⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\8B0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"
        321⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\8BC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"
        322⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\8C82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C82.tmp"
        323⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\8D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"
        324⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\91D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91D1.tmp"
        325⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\92BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92BC.tmp"
        326⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\9387.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9387.tmp"
        327⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\9442.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9442.tmp"
        328⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\950D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\950D.tmp"
        329⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\95C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95C9.tmp"
        330⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\9684.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9684.tmp"
        331⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\9730.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9730.tmp"
        332⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\97DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97DC.tmp"
        333⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\9898.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9898.tmp"
        334⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\9992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9992.tmp"
        335⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\9A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A1E.tmp"
        336⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\9ACA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"
        337⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\9B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B95.tmp"
        338⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\9C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C70.tmp"
        339⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\9D1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D1C.tmp"
        340⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\9DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"
        341⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\9EB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"
        342⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\9F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F5E.tmp"
        343⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\A01A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A01A.tmp"
        344⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\A0D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"
        345⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\A1A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1A0.tmp"
        346⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\A26B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A26B.tmp"
        347⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\A356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A356.tmp"
        348⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\A402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A402.tmp"
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\A4AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"
        350⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\A53A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A53A.tmp"
        351⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\A605.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A605.tmp"
        352⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\A6D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"
        353⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\A77C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A77C.tmp"
        354⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\A847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A847.tmp"
        355⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\A912.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A912.tmp"
        356⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\A9CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9CE.tmp"
        357⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\AAA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAA9.tmp"
        358⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\AB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB55.tmp"
        359⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\AC00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC00.tmp"
        360⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\ACBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACBC.tmp"
        361⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\AD68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD68.tmp"
        362⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\AE43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE43.tmp"
        363⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\AEEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEEE.tmp"
        364⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\AFAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFAA.tmp"
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\B065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B065.tmp"
        366⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\B131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B131.tmp"
        367⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\B1EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1EC.tmp"
        368⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\B2B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2B7.tmp"
        369⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\B3A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3A2.tmp"
        370⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\B44D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B44D.tmp"
        371⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\B528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B528.tmp"
        372⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\B5E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E4.tmp"
        373⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\B690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B690.tmp"
        374⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\B74B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B74B.tmp"
        375⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\B816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B816.tmp"
        376⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\B8D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8D2.tmp"
        377⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\B99D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B99D.tmp"
        378⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\BA58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA58.tmp"
        379⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\BB04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB04.tmp"
        380⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\BBCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBCF.tmp"
        381⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\BCBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"
        382⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\BD75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD75.tmp"
        383⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\BE21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE21.tmp"
        384⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\BEDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEDD.tmp"
        385⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\BFA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFA8.tmp"
        386⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\C063.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C063.tmp"
        387⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\C10F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C10F.tmp"
        388⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\C1DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1DA.tmp"
        389⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\C2A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2A5.tmp"
        390⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\C342.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C342.tmp"
        391⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\C3ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3ED.tmp"
        392⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\C4B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4B9.tmp"
        393⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\C574.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C574.tmp"
        394⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\C630.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C630.tmp"
        395⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\C6EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6EB.tmp"
        396⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\C7A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7A7.tmp"
        397⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\C852.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C852.tmp"
        398⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\C8FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8FE.tmp"
        399⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\C9BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9BA.tmp"
        400⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\CA56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA56.tmp"
        401⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\CB21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB21.tmp"
        402⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\CBCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBCD.tmp"
        403⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\CC98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC98.tmp"
        404⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\CD54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD54.tmp"
        405⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\CE1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE1F.tmp"
        406⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\CEEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEEA.tmp"
        407⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\CF96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF96.tmp"
        408⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\D051.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D051.tmp"
        409⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\D0FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0FD.tmp"
        410⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\D1A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1A9.tmp"
        411⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\D245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D245.tmp"
        412⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\D301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D301.tmp"
        413⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\D3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3FB.tmp"
        414⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\D497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D497.tmp"
        415⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\D562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D562.tmp"
        416⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\D62D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D62D.tmp"
        417⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\D6E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6E9.tmp"
        418⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\D7B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7B4.tmp"
        419⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\D86F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D86F.tmp"
        420⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\D91B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D91B.tmp"
        421⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\D9E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9E6.tmp"
        422⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\DAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAA2.tmp"
        423⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\DB7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB7D.tmp"
        424⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\DC57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC57.tmp"
        425⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\DD03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD03.tmp"
        426⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\DDFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDFD.tmp"
        427⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\DEC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEC8.tmp"
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\DF74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF74.tmp"
        429⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\E05F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E05F.tmp"
        430⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\E11A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E11A.tmp"
        431⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\E1C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1C6.tmp"
        432⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\E291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E291.tmp"
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\E35C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E35C.tmp"
        434⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\E418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E418.tmp"
        435⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\E4D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"
        436⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\E5AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"
        437⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\E698.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E698.tmp"
        438⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\E764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E764.tmp"
        439⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\E80F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E80F.tmp"
        440⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\E8FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8FA.tmp"
        441⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\E9B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9B5.tmp"
        442⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\EA90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA90.tmp"
        443⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\EB3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB3C.tmp"
        444⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\EBF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBF7.tmp"
        445⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\ECA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECA3.tmp"
        446⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\ED7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED7E.tmp"
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\EE59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE59.tmp"
        448⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\EF05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF05.tmp"
        449⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\EFB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFB1.tmp"
        450⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\F06C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F06C.tmp"
        451⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\F118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F118.tmp"
        452⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\F1E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1E3.tmp"
        453⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\F2CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2CD.tmp"
        454⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\F399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F399.tmp"
        455⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\F435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F435.tmp"
        456⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\F4F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4F0.tmp"
        457⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\F5AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5AC.tmp"
        458⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\F667.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F667.tmp"
        459⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\F723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F723.tmp"
        460⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\F7CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7CF.tmp"
        461⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\F88A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F88A.tmp"
        462⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\F955.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F955.tmp"
        463⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\F9F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9F2.tmp"
        464⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\FA9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA9D.tmp"
        465⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\FB78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB78.tmp"
        466⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\FC14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC14.tmp"
        467⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\FCEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCEF.tmp"
        468⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\FDBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDBA.tmp"
        469⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\FE85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE85.tmp"
        470⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\FF31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF31.tmp"
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\FFED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFED.tmp"
        472⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8.tmp"
        473⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\173.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\173.tmp"
        474⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\21F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21F.tmp"
        475⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\2CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CB.tmp"
        476⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\377.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\377.tmp"
        477⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\452.tmp"
        478⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\4EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EE.tmp"
        479⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\5AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA.tmp"
        480⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\665.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\665.tmp"
        481⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\721.tmp"
        482⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\7EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EC.tmp"
        483⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\888.tmp"
        484⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\963.tmp"
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1E.tmp"
        486⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF9.tmp"
        487⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\BB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB4.tmp"
        488⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\C9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9F.tmp"
        489⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\D4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4B.tmp"
        490⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\E16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E16.tmp"
        491⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\ED1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED1.tmp"
        492⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\F7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D.tmp"
        493⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\1048.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1048.tmp"
        494⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\1104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1104.tmp"
        495⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\11CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11CF.tmp"
        496⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\129A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\129A.tmp"
        497⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\1375.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1375.tmp"
        498⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\1421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1421.tmp"
        499⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\14CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14CD.tmp"
        500⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\1598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1598.tmp"
        501⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\1644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1644.tmp"
        502⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\16FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16FF.tmp"
        503⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\17DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17DA.tmp"
        504⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\18B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18B5.tmp"
        505⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\1980.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1980.tmp"
        506⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\1A2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A2C.tmp"
        507⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\1B06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B06.tmp"
        508⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\1BB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB2.tmp"
        509⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\1CBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CBC.tmp"
        510⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\1D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D58.tmp"
        511⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\1E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E33.tmp"
        512⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\1EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EDF.tmp"
        513⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\1F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9A.tmp"
        514⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\2075.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2075.tmp"
        515⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\215F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\215F.tmp"
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\223A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\223A.tmp"
        517⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\2353.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2353.tmp"
        518⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\242E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\242E.tmp"
        519⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\24EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24EA.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\25C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25C4.tmp"
        521⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\268F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\268F.tmp"
        522⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\276A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\276A.tmp"
        523⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\2835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2835.tmp"
        524⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\2910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2910.tmp"
        525⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\29CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29CC.tmp"
        526⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\2AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AD5.tmp"
        527⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\2BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA0.tmp"
        528⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\2C6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C6B.tmp"
        529⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\2D56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D56.tmp"
        530⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\2E02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E02.tmp"
        531⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\2EEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EEC.tmp"
        532⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\2F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F98.tmp"
        533⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\3082.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3082.tmp"
        534⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\313E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\313E.tmp"
        535⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\3238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3238.tmp"
        536⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\3322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3322.tmp"
        537⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\33ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33ED.tmp"
        538⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\34C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34C8.tmp"
        539⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\3574.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3574.tmp"
        540⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\362F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\362F.tmp"
        541⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\36DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36DB.tmp"
        542⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\37D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37D5.tmp"
        543⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\38A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38A0.tmp"
        544⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\394C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\394C.tmp"
        545⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\3A08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A08.tmp"
        546⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\3AF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AF2.tmp"
        547⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\3BCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BCD.tmp"
        548⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\3CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CA8.tmp"
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\3D92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D92.tmp"
        550⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\3EAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EAB.tmp"
        551⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        552⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\4070.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4070.tmp"
        553⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\414B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\414B.tmp"
        554⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\4226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4226.tmp"
        555⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\4310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4310.tmp"
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\43CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43CC.tmp"
        557⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\44B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44B6.tmp"
        558⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\4562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4562.tmp"
        559⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\460E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\460E.tmp"
        560⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\46F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46F8.tmp"
        561⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\47E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47E3.tmp"
        562⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\48AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48AE.tmp"
        563⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\49A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49A8.tmp"
        564⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\4A92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A92.tmp"
        565⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\4B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4E.tmp"
        566⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\4C28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C28.tmp"
        567⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\4D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D03.tmp"
        568⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\4DFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DFD.tmp"
        569⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\4EF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EF7.tmp"
        570⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\4FF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FF1.tmp"
        571⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\50CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50CC.tmp"
        572⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\51B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51B6.tmp"
        573⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\52A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52A1.tmp"
        574⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\537B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\537B.tmp"
        575⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\5437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5437.tmp"
        576⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\5521.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5521.tmp"
        577⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\563B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\563B.tmp"
        578⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\5715.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5715.tmp"
        579⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\5800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5800.tmp"
        580⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\58BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58BB.tmp"
        581⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\59A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59A6.tmp"
        582⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\5A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A90.tmp"
        583⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\5B6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B6B.tmp"
        584⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\5C65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C65.tmp"
        585⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\5D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D30.tmp"
        586⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\5DEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DEB.tmp"
        587⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\5EB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EB6.tmp"
        588⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\5FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FA1.tmp"
        589⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\605C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\605C.tmp"
        590⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\6127.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6127.tmp"
        591⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\6202.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6202.tmp"
        592⤵
        System Location Discovery: System Language Discovery
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\62DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62DD.tmp"
        593⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\63B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63B8.tmp"
        594⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\6492.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6492.tmp"
        595⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\655E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\655E.tmp"
        596⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\6638.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6638.tmp"
        597⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\6703.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6703.tmp"
        598⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\67CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67CF.tmp"
        599⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\688A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\688A.tmp"
        600⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\6936.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6936.tmp"
        601⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\69E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69E2.tmp"
        602⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\6AAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AAD.tmp"
        603⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\6B97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B97.tmp"
        604⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\6C62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C62.tmp"
        605⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\6D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D1E.tmp"
        606⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\6DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DE9.tmp"
        607⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\6EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EA5.tmp"
        608⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\6F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F9F.tmp"
        609⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\705A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\705A.tmp"
        610⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\7135.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7135.tmp"
        611⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\7200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7200.tmp"
        612⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\72DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72DB.tmp"
        613⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\7396.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7396.tmp"
        614⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\7461.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7461.tmp"
        615⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\751D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\751D.tmp"
        616⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\75E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75E8.tmp"
        617⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\76A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76A3.tmp"
        618⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\777E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\777E.tmp"
        619⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\7849.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7849.tmp"
        620⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\7924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7924.tmp"
        621⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\79E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79E0.tmp"
        622⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\7AE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AE9.tmp"
        623⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\7BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BC4.tmp"
        624⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\7C7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C7F.tmp"
        625⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\7D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"
        626⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\7E16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E16.tmp"
        627⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\7ED1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"
        628⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\7F9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F9C.tmp"
        629⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\8058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8058.tmp"
        630⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\8133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8133.tmp"
        631⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\81DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81DE.tmp"
        632⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\829A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\829A.tmp"
        633⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\8394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8394.tmp"
        634⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\845F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\845F.tmp"
        635⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\852A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\852A.tmp"
        636⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\85D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85D6.tmp"
        637⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\86B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86B1.tmp"
        638⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\878C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\878C.tmp"
        639⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\8847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8847.tmp"
        640⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\8922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8922.tmp"
        641⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\8A0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A0C.tmp"
        642⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\8AC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC8.tmp"
        643⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\8BA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BA2.tmp"
        644⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\8C4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C4E.tmp"
        645⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\8D0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D0A.tmp"
        646⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\8DA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DA6.tmp"
        647⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\8E71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E71.tmp"
        648⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\8F3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F3C.tmp"
        649⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\8FF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FF8.tmp"
        650⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\90C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90C3.tmp"
        651⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\916F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\916F.tmp"
        652⤵
        
        PID:6608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

484A.tmp

Path C:\Users\Admin\AppData\Local\Temp\484A.tmp
Size 3.6MB
SHA256 ba9c1bfe0aab4aba2933455db563bdf917ec9da6e6b95d99fc3cdaffe742db2d
MD5 4f321e80fc61221015ed6bd99ff3da93
SHA1 c21e32a31d4b15b247873abf752b9935889bd20e
SHA512 ccbdf3229b479c99678660d4e99749809e059c6062270ce0c5debe8f36aedeb0e48e4193efaa67e7092eb61be3ff640fb9d762f45a28195407a21fe6108a0796
SSDEEP 49152:w/OJD6x49ENGEADt7i+/yTukuFGNLrkBirx:EOY49EchrSiGdkBirx
TLSH
T10C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\49FF.tmp
Size 3.6MB
SHA256 467f845c60a7adc1dc3c8187d04b0ec68033c6eb5256f1302fd49a05a2cb679d
MD5 736a1694825f8ac210231a31d3f0e312
SHA1 392585e37f5dbeeab1cf87d3d6487044f9880cda
SHA512 fc1a777c59a1f137163632754bd6756bcc00325826ee82240e0695e4ec9544410a417c48e011b1f725e2555d8404003baf50a45772c723fcef093f9d2c53beeb
SSDEEP 49152:w/OJDGe8HxPbfNGEADt7i+/yTukuFGNLrkBirx:EOz8HxjchrSiGdkBirx
TLSH
T15806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E07.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E07.tmp
Size 3.6MB
SHA256 b1bfeb8e969ce32f768e817e96bd2f2137de7ef42dfca7ba8a795770e356a291
MD5 fe9430bdf62f114793e11eef41063faa
SHA1 4554b630dfc7ab64dbd611774a15702d42bdc6f2
SHA512 cd279ae54d1503d0bf18ef5254ed76eb75b6f48ab3c2093c3f48fcce6d846daab60a150929c76b68dbe1f46ee670b78e0e8b2711fddcd80fe7747e663999bcfe
SSDEEP 49152:w/OJDi8R599SNGEADt7i+/yTukuFGNLrkBirx:EO48zSchrSiGdkBirx
TLSH
T15F06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4EF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4EF1.tmp
Size 3.6MB
SHA256 06d24695a0cb3e4a1440a8f296ae75b19a1fd9d16f3e4422ad554d32f768e100
MD5 e6fa630e28b78b1122574631e0e373b6
SHA1 6cfbb9e256d54eb0a0e4716d21da97ea4d36e145
SHA512 a46ed2c24265347465c714272221371327848579a1b1182b514b835c468874273381fca3b9ceb9b0b2d38a93b5a22974f413e80756fc6cfe349838be32de8980
SSDEEP 49152:w/OJD+RTNzeqfuNGEADt7i+/yTukuFGNLrkBirx:EOcRBzeq2chrSiGdkBirx
TLSH
T18406931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\53E3.tmp
Size 3.6MB
SHA256 dbcefb947e24ae73b3a86694c7aced654ad62ad1df4621fe3a5bc57f3a59ad12
MD5 c1ba5007aef1530cf2f80016b50f1dd3
SHA1 41180a50b5e4f86cf7f85d6e8f3dcfab2b95ef3b
SHA512 1b7bbcb89eb5c3cde2ee58b13c137e5ff9dda2b908b556ce1b0a5e9fb9508b31f690d9182a42c660c63284145c28edd53afa48f2169f75431053f3161060a8c9
SSDEEP 49152:w/OJD3phTuNGEADt7i+/yTukuFGNLrkBirx:EObBuchrSiGdkBirx
TLSH
T18F06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

572E.tmp

Path C:\Users\Admin\AppData\Local\Temp\572E.tmp
Size 3.6MB
SHA256 7dc2aba5abe3e79e7af5ab449e465b14320b12b17bd46a40e82ecacecdac92e6
MD5 211dbfe5956ad6c71d47d8c99aa9df1f
SHA1 329012827400cbbaac40d36d838e8ead8adbcdae
SHA512 93fd4f84b28d281b840f26b9fcbfc4e73dfb1e9bc0cac10e3cc39eb62184df40d8ec38c095d76d3a2d81190cabc3993a752b95a5c2855562540c151592c55f94
SSDEEP 49152:w/OJDqyftx1NGEADt7i+/yTukuFGNLrkBirx:EO4a1chrSiGdkBirx
TLSH
T1C506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A1C.tmp
Size 3.6MB
SHA256 c0b12ec6d037c200a2ef0a1667ae040a1d09cfde244b10a73d97961cb20f821e
MD5 3cf1e8daa9405f6a3634a33243a9e56f
SHA1 14e0756e9c3ae78f7f23c1847852d7a2df92a5cd
SHA512 878d8b830d10d5b93c763cd71816d52478fc46b536b5544c23e5e17ff6d7a280423cf4700c5b31b45818889fb3a4eb74f8276d95e4ce38b9fa6a866c9d6e5c83
SSDEEP 49152:w/OJDybioNGEADt7i+/yTukuFGNLrkBirx:EOgb9chrSiGdkBirx
TLSH
T19206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\5B07.tmp
Size 3.6MB
SHA256 8db22409c5ac02b61facf08fa54c48acee0b0bbbcd8e4bf34707280d703b8274
MD5 22552aa4591ea36c859a3d7edd75a6ac
SHA1 b54621e347abc5efbd1103d3bdceeeb72f241db8
SHA512 6663e17b51e56231bf611eaaaacde61c5bb8890aa39fa912eab8742130b0a405212b392a0377f0d5fdb2c5c5b2a687755a965f00d3ea8c45fd281bffe3c56d5c
SSDEEP 49152:w/OJDYuLHdfEsNGEADt7i+/yTukuFGNLrkBirx:EO9BhchrSiGdkBirx
TLSH
T1AE06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5EEF.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EEF.tmp
Size 3.6MB
SHA256 5d716cf788b2e1e7b17e4ad10f683af728475711042cf62086b01b953fcc32ca
MD5 08d0cec7cb77ffa66b13596030a399fd
SHA1 7e5b883a7421402782db0a324981c01e0ba8814b
SHA512 a38838de91ee39289103c1b9808a637759e20c1a5023a2d99f15d56fed4866f3c66537ebf64c24444ba4f1ebd0efa4a9c2889d068f7d371d112c20477b5d5455
SSDEEP 49152:w/OJDmiPNLD2NGEADt7i+/yTukuFGNLrkBirx:EOH2chrSiGdkBirx
TLSH
T15306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

621B.tmp

Path C:\Users\Admin\AppData\Local\Temp\621B.tmp
Size 3.6MB
SHA256 608e4df77f1412def0ae5edad19004e0267fab3450bcd8b71f0d5c8067d4f965
MD5 9cafed62156aea77030605bacc69db57
SHA1 57dcb8c157a6da370eff8d617d899433bd8b93ab
SHA512 e135389ee4d26f665b11be22c2a947250024ee9e8245fd95945e56b3bdeba81e01ccf21fa932eb798afc58775bed682040c42186edc5f60b0b0d7d649cb5ede6
SSDEEP 49152:w/OJD84NGEADt7i+/yTukuFGNLrkBirx:EOK4chrSiGdkBirx
TLSH
T17706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6548.tmp

Path C:\Users\Admin\AppData\Local\Temp\6548.tmp
Size 3.6MB
SHA256 b89706a53bc9084ebf27e6dae21381087f7d6a469e5d860e9621c1fb90d38c1d
MD5 0329861bfee65e3f9477bb3f3a2c07a2
SHA1 ff823cc305de67116c23e85dbfdc637b29bafae3
SHA512 93fa5131f82e310f68e5ddf2135dde6d7746261c75da5acaa35f6dd724248294dfce3d2429d76e921aa1d0dc64c57fb4e97650f7a62cac1b99a92e90988420bf
SSDEEP 49152:w/OJD7KP0fNGEADt7i+/yTukuFGNLrkBirx:EO1KPychrSiGdkBirx
TLSH
T1CA06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\68A3.tmp
Size 3.6MB
SHA256 43f59bc75e0e35fe7f0ae16ae1b78a84ca85b47293270e0352b648c4834aa872
MD5 c2efea2789326bde2d10470037f346bd
SHA1 e034c8b3c2dbb233590eebee1bfdd4cd1b25ab52
SHA512 9a2e41656c5f3599d3ac4e0731e4db911195097a64d06d741f412ebbd6c88b6a5cf69494aedab670caa6e9e2fc2fea14d7a10098928f0301bf4a208b922bcd29
SSDEEP 49152:w/OJDlf3M4NGEADt7i+/yTukuFGNLrkBirx:EOs4chrSiGdkBirx
TLSH
T19206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6BA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\6BA1.tmp
Size 3.6MB
SHA256 0e4979129e1e9ee6c1a208466dacddadc62bf055821d6cfa85ce907c5fd87af1
MD5 a34967b17e5f8323914a29e095ad93f6
SHA1 130ad3757884b4c0d6d840a5212c54ae34cb0e8e
SHA512 552275b36b361bf027d4dfa6eec590b9f041414276c3028ede3c6f083b08e86b310e6a32f76ee4b9237e9c662c64ad2d6aabb96d4cf099db76e1414af808a57b
SSDEEP 49152:w/OJD41cDNGEADt7i+/yTukuFGNLrkBirx:EOnchrSiGdkBirx
TLSH
T1EF06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6F0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\6F0C.tmp
Size 3.6MB
SHA256 0bd5fe4623d0ee5952c158147298cc9a414cdd4e34f1072e335a744a342effa2
MD5 2eb3f73efa0a5cabdc633b61187b76b0
SHA1 50188b76f186445667b2ddbb043c8de3624d671f
SHA512 0e2e6ebca5a9d8444672abd4f1a98c738a328f649d8ef39ea9fef631210fe456fc7a2a1000d663f742adc6b66c0cf76bef3f79bf07c9b08ac6d37947d1bf66a0
SSDEEP 49152:w/OJDMWvygChmNGEADt7i+/yTukuFGNLrkBirx:EO2WhCcchrSiGdkBirx
TLSH
T12806831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7238.tmp

Path C:\Users\Admin\AppData\Local\Temp\7238.tmp
Size 3.6MB
SHA256 a7347039ba44d639c7c32ba747cadab88c60fcd3ed01c3ee169b790dff4729b7
MD5 e205c361800fc8803ad6212f11a5236f
SHA1 9d3b27778cd35ac3a371339ca1f4340dda5ca38d
SHA512 4a7e543b6354b7e64e64b2dd4aa83717cb1e0e4dca0c35f1df729da87485f8ea71a0c5cac1cbf24538f1618ae7c27d6f1969df8248ab0a6bde8cd92ee80c132d
SSDEEP 49152:w/OJDsv9T8hNGEADt7i+/yTukuFGNLrkBirx:EOK1IhchrSiGdkBirx
TLSH
T17006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\74A9.tmp
Size 3.6MB
SHA256 25b99614caabfbaa4fa92c36df767abdfe82234de17d47e2f4f5220ca9b6f111
MD5 2cfdb5c95f453c76910f942d62406fa3
SHA1 d4f2e0bb1932137995809c67604cf8aee2e4cabd
SHA512 ed456b91bbedbf860374b49513ff238e5aad857f6c8034443f64fb6df0ec79252b886fc0f390edd1afcf2cf03baba31505a899bce56c217710782fea24c3011c
SSDEEP 49152:w/OJD9/4QNGEADt7i+/yTukuFGNLrkBirx:EOr/chrSiGdkBirx
TLSH
T10106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7843.tmp

Path C:\Users\Admin\AppData\Local\Temp\7843.tmp
Size 3.6MB
SHA256 ca1860ee01b380be0f8146ae72bf1eb5416c1e60002b0fc5c53832cc6293b26b
MD5 fc28336fa816264843b935549fe726ac
SHA1 33e967b14de8e3666c2528ff0aecf9072690ca9d
SHA512 7807e9bf6b1e0f2c76d5c1842357cf0c6d227e57c35e37e350d79d2d6bf097d812faf1d9586c2e3186add45da159b34e51e43599beaa09efd80e7f93f43e8f16
SSDEEP 49152:w/OJDfshqyNGEADt7i+/yTukuFGNLrkBirx:EOioychrSiGdkBirx
TLSH
T17A06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B8F.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B8F.tmp
Size 3.6MB
SHA256 1bade0b63920c23454f989f22f770d71a92daf40ef380e0ca96d03d68df5e7ca
MD5 85963bda7bb65abb66c6c44cc4966c98
SHA1 1cd437278ae420803f7583a6ecf0ff95f149d015
SHA512 85d1ec68ba12483d0217fa1a248b66ab288591ab1e61007c60ec5c75f43781311c9d54645c4ce28dac162bdd8fcbf9e7b18d5eab76f3540060b36aad2dad1228
SSDEEP 49152:w/OJDW4gONDNGEADt7i+/yTukuFGNLrkBirx:EO5lNDchrSiGdkBirx
TLSH
T11106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D25.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D25.tmp
Size 3.6MB
SHA256 0e8fbd1e22a84b84f1c8407f17d245b5cd2eb70706d2ebf189621c617506fde1
MD5 1dd8200fc5b71b1196098819fcfbb128
SHA1 3945ea67aea371534d571679bbb3ca05b9058cc3
SHA512 bf1cba3d56c8008c1c4ec6f37c03d8be1cc1e6c6c7eadfe77e3e356c432e0960dc3143454b66f463ab07cc55290260b9966b172daaadacd3848524eb09fa5319
SSDEEP 49152:w/OJDf1PQ/NGEADt7i+/yTukuFGNLrkBirx:EOZ1PQ/chrSiGdkBirx
TLSH
T17106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8284.tmp

Path C:\Users\Admin\AppData\Local\Temp\8284.tmp
Size 3.6MB
SHA256 799b07fa95738d02be31288669109b94e18fda60164f1bc31a4f348b2e52d2b7
MD5 58a2bd623c7e549a7aa5a98d031dcc49
SHA1 31ec3bdc43e60838de5892b4d7e370393419b4b3
SHA512 2251e086085ed68e4d787643d528d74fe958453f96caef39853ebe1d8853fe1626c66e183110302530773ea3f3b8ba9a7962b50042072cd5b904e352cf6d33c8
SSDEEP 49152:w/OJDvtbDBNGEADt7i+/yTukuFGNLrkBirx:EOj1chrSiGdkBirx
TLSH
T1A206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

862E.tmp

Path C:\Users\Admin\AppData\Local\Temp\862E.tmp
Size 3.6MB
SHA256 bbc1b4d261bc1d8a7b66678f22ec2ac28b382aeebbdf159d4a39433fa2b72523
MD5 f8f741db51ff183b76bacec859bbaa69
SHA1 afc53070a038091a6158a4424a14b0dd07237acf
SHA512 8c96effa02bd807f5558e24fb53d5551f8642b8edc8f391366c5b20936e3d429ba45ac93f0172c46feef42fdea6e735c3dbed3e08d01ad2689f0e4f133a76474
SSDEEP 49152:w/OJDlsXRouNGEADt7i+/yTukuFGNLrkBirx:EOrsXiuchrSiGdkBirx
TLSH
T1A606831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

890C.tmp

Path C:\Users\Admin\AppData\Local\Temp\890C.tmp
Size 3.6MB
SHA256 33594166363f24961268bd95fbefd791b5768d045c42668a4dab8281e700f32d
MD5 20d5fa555f7f5dd9095b928cbd1d0d4c
SHA1 1461bd5883763e5de8e9c9a258e3672079dee78e
SHA512 f64163600288d78804c2418d6b14bd9722a24c30e9fab25d9d92e294b6cd65e2dd395f60215ea323b8d7e5fdd76248a4758f648dc803f316327081fc0dbfc880
SSDEEP 49152:w/OJDx4fVlNGEADt7i+/yTukuFGNLrkBirx:EO/4fTchrSiGdkBirx
TLSH
T17C06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8C0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C0A.tmp
Size 3.6MB
SHA256 446c5c199a745d78007a09438c89e838b90a0a2186f1e45479ca078c2a795f2d
MD5 732a02a6f735d7c93c08cac5364ab73f
SHA1 018df87775a25b47599b839dec99e4133e3b4676
SHA512 db8130ff727dbf5bbcba759036faea53d0a2acc9d6f38c4d1a7daafa470d04aef7ade9eff3fd9cecc3865b48e742b4dbbad93e9742e5add03152f493cfa532d9
SSDEEP 49152:w/OJDnsyqNGEADt7i+/yTukuFGNLrkBirx:EOSyqchrSiGdkBirx
TLSH
T10406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9021.tmp

Path C:\Users\Admin\AppData\Local\Temp\9021.tmp
Size 3.6MB
SHA256 4b1c4ed824b6304170efeb917603255fdf58d5aae02d1271890ac1a829ee3416
MD5 1d9bdedced14afc912b6df9cb2faf64e
SHA1 e91690202c8536206861b59fd82ded82f8c5d2a3
SHA512 f4db901e2e037742a31632d22d5f8edf6ca6fd10b20e40c91d740afcf92611db0ae8f6ae0caf7097e050481a6951fb6711e09131a9716c9b25f68a0e560c095a
SSDEEP 49152:w/OJDntEhMNGEADt7i+/yTukuFGNLrkBirx:EOEhMchrSiGdkBirx
TLSH
T13306931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

934D.tmp

Path C:\Users\Admin\AppData\Local\Temp\934D.tmp
Size 3.6MB
SHA256 00e21655ac45fef64c033d97064d1a3cfd3d8388d43627be57676086469fc859
MD5 a5840811c89aa6b2330c5758287d8b06
SHA1 b9ea105d181348bd0e7c81b6c2d8547c8de21004
SHA512 1fb9b82fadd432b0ca3c99e8defc77c0d8c9270f68a8f02c27d3d0d02f2f9381fb4569fffe5ad60493012a870e5d31dd68cb850fcf7feb06cda3b906d8193260
SSDEEP 49152:w/OJD9FEjnHNGEADt7i+/yTukuFGNLrkBirx:EOp+HchrSiGdkBirx
TLSH
T1C106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

961C.tmp

Path C:\Users\Admin\AppData\Local\Temp\961C.tmp
Size 3.6MB
SHA256 61880b9db8329186fab1f777d0bcf4280d0430181f144a096ef15a6c228916b6
MD5 c065533ee216f42f248b8dc2da7d1cdb
SHA1 636f02271cd8d20fff7040d3ec19ba6ed45d7ab6
SHA512 ef7ee12a46501ecb7f938299a25d9d429563b0e9b8c7d4aeebc61dac99467ff3c38c60e54aee854e51b52be21284935723ac930254f21da1b65fbbc17a499c62
SSDEEP 49152:w/OJDQ29NGEADt7i+/yTukuFGNLrkBirx:EOWWchrSiGdkBirx
TLSH
T16806831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9939.tmp

Path C:\Users\Admin\AppData\Local\Temp\9939.tmp
Size 3.6MB
SHA256 0d17a7501ab85d6c8a39ac80a09d16396866345d9a734728fb016d079d5893ae
MD5 db0d714a3c7243733d78771336d72c5b
SHA1 9d62a49d0f570d712bee51eacb8c87813ff10e8d
SHA512 10e48681bdd9bbe9c04fb5bebe6531308c31c90155411e60392fdf84b3fd423d672b4e5269d60879188e1851684158a676450d0882e9c363aa4606d22f355c4e
SSDEEP 49152:w/OJD1airQc26NGEADt7i+/yTukuFGNLrkBirx:EOCYq6chrSiGdkBirx
TLSH
T19F06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9C65.tmp

Path C:\Users\Admin\AppData\Local\Temp\9C65.tmp
Size 3.6MB
SHA256 9d4e4d30e38426562bd738813bb919c796a4258a64f9784fc97ba9d7e36a7063
MD5 98f934d24d35ce59c91e9a6ecc34e076
SHA1 fee42613b42099a314e44c262f3b72b7939862cb
SHA512 fd893a6ec7dc4078759e0150f859020441c114b10f2914913479dab5225e4f60788bef1934a91af1fdea0a9891b709a794b2968fb2188f6c854bb153b679867d
SSDEEP 49152:w/OJDBaC/NGEADt7i+/yTukuFGNLrkBirx:EO7aC/chrSiGdkBirx
TLSH
T1FB06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9F44.tmp

Path C:\Users\Admin\AppData\Local\Temp\9F44.tmp
Size 3.6MB
SHA256 81b3f2aa97686b072f94db52b59ebfcd65b535feeb467b67556bd12f15d5c80b
MD5 26986d23fc5a4e317697d59fc0f60b98
SHA1 0f9fe99f9b4d0a52c768aabdae82f7258783780a
SHA512 85de34772a4e288579797c4b30ac07c7a575002d7efa0ce41f0d760566e1a1bea98974a9326ffdc365d4cf2fd1c09e8a9c6dad25922ae6d302e01ed11d0b9046
SSDEEP 49152:w/OJD66fYkNGEADt7i+/yTukuFGNLrkBirx:EOopkchrSiGdkBirx
TLSH
T15606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A2BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\A2BE.tmp
Size 3.6MB
SHA256 1156e68e882221207ece227d14135b076920bb6967711dd901e7126cc55efb51
MD5 a3e21fa98de56cd1cd59632954a8204c
SHA1 fdad27f1911ef6150df6cb1dc51a3dfeded3034d
SHA512 d89217c481fa7188814321fa70df186efbf530821485060b9b450f32d41bf97c22e0121b18c4e41495882f853e381699f6bc28cdbe937ed9b399d826f6137543
SSDEEP 49152:w/OJDPb93D/fQHNGEADt7i+/yTukuFGNLrkBirx:EO73D/oHchrSiGdkBirx
TLSH
T1C306831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A5BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\A5BC.tmp
Size 3.6MB
SHA256 47010a0d80497dd4cf695370db9ffd53c83a4bb8708b3f731f1bb1f6bc497f28
MD5 68c0d20c33121557edf8953c9b6003af
SHA1 9c74713a931c331da7f9fa97755fe41c910e4c88
SHA512 8baf2b471f756cf8bbc89881a20b61ac7cb53b33a3832c173aae7a44a91ce5df178834ab4ab2650b242a25bb51c9ebd2acee122dfc398b8e25f09418a0be9039
SSDEEP 24576:wUQOJDHkUWNGEAFC5etW0Ri+aMyFH1K/PkuRe8GNLJhkBir2ZPevL:w/OJDSNGEADt7i+/yTukuFGNLrkBirx
TLSH
T13706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A917.tmp

Path C:\Users\Admin\AppData\Local\Temp\A917.tmp
Size 3.6MB
SHA256 0ce1b29ba57342ce8a797df6bfc2074c5522a33af45f8f8edca3a6efe721c429
MD5 9595a2aa476ddd41e339e4ca8d189484
SHA1 352b0b02bafac1b99b078290a279f44b8f57ea0c
SHA512 d6540573afa2b6febdbc060361b81c3b51000658e09e0631222be1b1be9fe967221ff0374d88ee8c0516eb3f6f718e07eef612257054738d3e21cad3f83e3cd7
SSDEEP 49152:w/OJDsjwkVNGEADt7i+/yTukuFGNLrkBirx:EOKMEchrSiGdkBirx
TLSH
T1CD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-68-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/252-76-0x0000000000880000-0x0000000000903000-memory.dmp

Download

memory/1056-229-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/1056-224-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/1148-125-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1148-131-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/1184-83-0x00000000006A0000-0x0000000000723000-memory.dmp

Download

memory/1184-75-0x00000000006A0000-0x0000000000723000-memory.dmp

Download

memory/1228-273-0x0000000000190000-0x0000000000213000-memory.dmp

Download

memory/1228-279-0x0000000000190000-0x0000000000213000-memory.dmp

Download

memory/1248-146-0x0000000000060000-0x00000000000E3000-memory.dmp

Download

memory/1248-138-0x0000000000060000-0x00000000000E3000-memory.dmp

Download

memory/1544-258-0x0000000000A50000-0x0000000000AD3000-memory.dmp

Download

memory/1544-264-0x0000000000A50000-0x0000000000AD3000-memory.dmp

Download

memory/1716-153-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/1716-145-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/1756-96-0x0000000000420000-0x00000000004A3000-memory.dmp

Download

memory/1756-105-0x0000000000420000-0x00000000004A3000-memory.dmp

Download

memory/1916-166-0x00000000008A0000-0x0000000000923000-memory.dmp

Download

memory/1916-174-0x00000000008A0000-0x0000000000923000-memory.dmp

Download

memory/1960-294-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/1960-299-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/2096-181-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2096-188-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2388-63-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/2388-54-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/2424-233-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/2424-239-0x0000000000AD0000-0x0000000000B53000-memory.dmp

Download

memory/2512-234-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/2512-228-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/2756-202-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/2756-194-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/2860-42-0x0000000000230000-0x00000000002B3000-memory.dmp

Download

memory/2860-48-0x0000000000230000-0x00000000002B3000-memory.dmp

Download

memory/3012-89-0x0000000000480000-0x0000000000503000-memory.dmp

Download

memory/3012-98-0x0000000000480000-0x0000000000503000-memory.dmp

Download

memory/3056-139-0x0000000000840000-0x00000000008C3000-memory.dmp

Download

memory/3056-132-0x0000000000840000-0x00000000008C3000-memory.dmp

Download

memory/3096-69-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/3096-62-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/3136-34-0x0000000000DC0000-0x0000000000E43000-memory.dmp

Download

memory/3136-26-0x0000000000DC0000-0x0000000000E43000-memory.dmp

Download

memory/3604-238-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3604-244-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3680-209-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3680-201-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3792-215-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/3792-208-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/3852-56-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/3852-47-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/3936-167-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/3936-159-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/4068-293-0x0000000000300000-0x0000000000383000-memory.dmp

Download

memory/4068-288-0x0000000000300000-0x0000000000383000-memory.dmp

Download

memory/4124-19-0x0000000000BC0000-0x0000000000C43000-memory.dmp

Download

memory/4124-28-0x0000000000BC0000-0x0000000000C43000-memory.dmp

Download

memory/4184-223-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/4184-217-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/4312-14-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/4312-6-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/4400-160-0x0000000000B50000-0x0000000000BD3000-memory.dmp

Download

memory/4400-152-0x0000000000B50000-0x0000000000BD3000-memory.dmp

Download

memory/4472-259-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/4472-253-0x00000000004C0000-0x0000000000543000-memory.dmp

Download

memory/4624-180-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/4624-173-0x00000000003D0000-0x0000000000453000-memory.dmp

Download

memory/4628-91-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/4628-82-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/4724-278-0x0000000000550000-0x00000000005D3000-memory.dmp

Download

memory/4724-284-0x0000000000550000-0x00000000005D3000-memory.dmp

Download

memory/4836-268-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/4836-274-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/4900-41-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/4900-33-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/4912-0-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/4912-7-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/4980-243-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/4980-249-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/4996-298-0x0000000000F20000-0x0000000000FA3000-memory.dmp

Download

memory/5012-103-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/5012-110-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/5036-12-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/5036-21-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/5380-254-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/5380-248-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/5604-124-0x0000000000E60000-0x0000000000EE3000-memory.dmp

Download

memory/5604-118-0x0000000000E60000-0x0000000000EE3000-memory.dmp

Download

memory/5672-269-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/5672-263-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/5700-111-0x00000000004F0000-0x0000000000573000-memory.dmp

Download

memory/5700-117-0x00000000004F0000-0x0000000000573000-memory.dmp

Download

memory/5744-187-0x00000000000F0000-0x0000000000173000-memory.dmp

Download

memory/5744-196-0x00000000000F0000-0x0000000000173000-memory.dmp

Download

memory/5784-289-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/5784-283-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/5796-303-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads