52959bf2606e2031a10f592e7e1cefd82c404bb96e0c31721c0817eabfa13e3d

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_5c4a959f0cc7adf37c042f33d9946bdd_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260808-rxhzdaydle
SHA256 52959bf2606e2031a10f592e7e1cefd82c404bb96e0c31721c0817eabfa13e3d
MD5 5c4a959f0cc7adf37c042f33d9946bdd
SHA1 4419b56349fc98ffd8657ee73ba90ec7e60ef3d2
SHA512 34fef85ea1798abec43ab29424eaa28330c04c23dcdaa3a2842bc6d225b60792ce4aec4ce5311a345cc1e7379776006ce0143a5436a767682419b802170de977
SSDEEP 49152:w/OJDzRhkKS77YDNGEADt7i+/yTukuFGNLrkBirx:EO9vRy0chrSiGdkBirx
TLSH
T18C06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4952	2689.tmp
1616	27E1.tmp
4112	2AB0.tmp
2064	2EB7.tmp
3292	330C.tmp
5744	3714.tmp
4624	39E2.tmp
1484	3D6D.tmp
1344	3EF3.tmp
2592	42EB.tmp
5492	4627.tmp
3304	4934.tmp
4808	4C03.tmp
204	5049.tmp
4116	5308.tmp
4968	5644.tmp
4300	5942.tmp
2056	5C30.tmp
5696	5EDF.tmp
3568	620C.tmp
2168	646D.tmp
2884	678A.tmp
4880	6B24.tmp
1060	6E21.tmp
5080	711F.tmp
5304	748A.tmp
4812	7788.tmp
1856	7A08.tmp
944	7D16.tmp
4244	7FD5.tmp
4468	8275.tmp
5068	8534.tmp
1044	8802.tmp
932	88FC.tmp
4612	89B8.tmp
5820	8AB2.tmp
5864	8BAC.tmp
5524	8CC5.tmp
3784	8E1D.tmp
2172	8F46.tmp
4892	906F.tmp
4732	9188.tmp
3172	92B1.tmp
6052	93CA.tmp
4232	94D4.tmp
1796	95BE.tmp
2992	96B8.tmp
5220	9793.tmp
4272	989C.tmp
5424	9996.tmp
3320	9A52.tmp
1516	9B3C.tmp
2296	9C17.tmp
852	9CE2.tmp
2836	9DAD.tmp
5868	9E78.tmp
4916	9F53.tmp
5640	A01E.tmp
4620	A0CA.tmp
2536	A195.tmp
5056	A260.tmp
2144	A33B.tmp
5580	A416.tmp
1360	A4D1.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B017.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D826.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F3FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	958.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A13.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	471C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DF2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69B8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A450.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D9B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	829F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C0E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	146F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29CC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8275.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D131.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D8E2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA87.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E64F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B84.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED6E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57B2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11C4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73BA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8500.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BF5A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C7F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5418.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D509.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E35.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA92.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E64A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DAD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A687.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B721.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1142.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	277A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A90.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6E28.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F591.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4661.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CC7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB7D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D354.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF5A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3327.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC4C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F01E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FE2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D6C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8CF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7788.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A7FE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC41.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B77A.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 4952	2716	2026-08-08_5c4a959f0cc7adf37c042f33d9946bdd_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4952 wrote to memory of 1616	4952	2689.tmp	90
PID 1616 wrote to memory of 4112	1616	27E1.tmp	91
PID 4112 wrote to memory of 2064	4112	2AB0.tmp	92
PID 2064 wrote to memory of 3292	2064	2EB7.tmp	93
PID 3292 wrote to memory of 5744	3292	330C.tmp	94
PID 5744 wrote to memory of 4624	5744	3714.tmp	95
PID 4624 wrote to memory of 1484	4624	39E2.tmp	96
PID 1484 wrote to memory of 1344	1484	3D6D.tmp	97
PID 1344 wrote to memory of 2592	1344	3EF3.tmp	98
PID 2592 wrote to memory of 5492	2592	42EB.tmp	99
PID 5492 wrote to memory of 3304	5492	4627.tmp	100
PID 3304 wrote to memory of 4808	3304	4934.tmp	101
PID 4808 wrote to memory of 204	4808	4C03.tmp	102
PID 204 wrote to memory of 4116	204	5049.tmp	103
PID 4116 wrote to memory of 4968	4116	5308.tmp	104
PID 4968 wrote to memory of 4300	4968	5644.tmp	105
PID 4300 wrote to memory of 2056	4300	5942.tmp	106
PID 2056 wrote to memory of 5696	2056	5C30.tmp	107
PID 5696 wrote to memory of 3568	5696	5EDF.tmp	108
PID 3568 wrote to memory of 2168	3568	620C.tmp	109
PID 2168 wrote to memory of 2884	2168	646D.tmp	110
PID 2884 wrote to memory of 4880	2884	678A.tmp	111
PID 4880 wrote to memory of 1060	4880	6B24.tmp	112
PID 1060 wrote to memory of 5080	1060	6E21.tmp	113
PID 5080 wrote to memory of 5304	5080	711F.tmp	114
PID 5304 wrote to memory of 4812	5304	748A.tmp	115
PID 4812 wrote to memory of 1856	4812	7788.tmp	116
PID 1856 wrote to memory of 944	1856	7A08.tmp	117
PID 944 wrote to memory of 4244	944	7D16.tmp	118
PID 4244 wrote to memory of 4468	4244	7FD5.tmp	119
PID 4468 wrote to memory of 5068	4468	8275.tmp	120
PID 5068 wrote to memory of 1044	5068	8534.tmp	121
PID 1044 wrote to memory of 932	1044	8802.tmp	122
PID 932 wrote to memory of 4612	932	88FC.tmp	123
PID 4612 wrote to memory of 5820	4612	89B8.tmp	124
PID 5820 wrote to memory of 5864	5820	8AB2.tmp	125
PID 5864 wrote to memory of 5524	5864	8BAC.tmp	126
PID 5524 wrote to memory of 3784	5524	8CC5.tmp	127
PID 3784 wrote to memory of 2172	3784	8E1D.tmp	128
PID 2172 wrote to memory of 4892	2172	8F46.tmp	129
PID 4892 wrote to memory of 4732	4892	906F.tmp	130
PID 4732 wrote to memory of 3172	4732	9188.tmp	131
PID 3172 wrote to memory of 6052	3172	92B1.tmp	132
PID 6052 wrote to memory of 4232	6052	93CA.tmp	133
PID 4232 wrote to memory of 1796	4232	94D4.tmp	134
PID 1796 wrote to memory of 2992	1796	95BE.tmp	135
PID 2992 wrote to memory of 5220	2992	96B8.tmp	136
PID 5220 wrote to memory of 4272	5220	9793.tmp	137
PID 4272 wrote to memory of 5424	4272	989C.tmp	139
PID 5424 wrote to memory of 3320	5424	9996.tmp	140
PID 3320 wrote to memory of 1516	3320	9A52.tmp	141
PID 1516 wrote to memory of 2296	1516	9B3C.tmp	142
PID 2296 wrote to memory of 852	2296	9C17.tmp	143
PID 852 wrote to memory of 2836	852	9CE2.tmp	144
PID 2836 wrote to memory of 5868	2836	9DAD.tmp	145
PID 5868 wrote to memory of 4916	5868	9E78.tmp	146
PID 4916 wrote to memory of 5640	4916	9F53.tmp	147
PID 5640 wrote to memory of 4620	5640	A01E.tmp	148
PID 4620 wrote to memory of 2536	4620	A0CA.tmp	149
PID 2536 wrote to memory of 5056	2536	A195.tmp	150
PID 5056 wrote to memory of 2144	5056	A260.tmp	151
PID 2144 wrote to memory of 5580	2144	A33B.tmp	152
PID 5580 wrote to memory of 1360	5580	A416.tmp	153

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5c4a959f0cc7adf37c042f33d9946bdd_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5c4a959f0cc7adf37c042f33d9946bdd_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\2689.tmp
  "C:\Users\Admin\AppData\Local\Temp\2689.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\27E1.tmp
    "C:\Users\Admin\AppData\Local\Temp\27E1.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\2AB0.tmp
      "C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\330C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\330C.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\3714.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3714.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\39E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39E2.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\3D6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\3EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\42EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42EB.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\4627.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4627.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\4934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4934.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\4C03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C03.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\5049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5049.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\5308.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5308.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\5644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5644.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\5942.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5942.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\5C30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C30.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\5EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\620C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\620C.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\646D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\646D.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\678A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\678A.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\6B24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B24.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\6E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E21.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\711F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\711F.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\748A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\748A.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\7788.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7788.tmp"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\7A08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A08.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\7D16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D16.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\7FD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\8275.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8275.tmp"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\8534.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8534.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\8802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8802.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\88FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88FC.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\89B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89B8.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\8AB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\8BAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\8CC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\8E1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\8F46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F46.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\906F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\906F.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\9188.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9188.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\92B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92B1.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\93CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93CA.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\94D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94D4.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\95BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95BE.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\96B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96B8.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\9793.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9793.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\989C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\989C.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\9996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9996.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\9A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A52.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\9B3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\9C17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C17.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\9CE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\9DAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\9E78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E78.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\9F53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F53.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\A01E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A01E.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\A0CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\A195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A195.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\A260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A260.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\A33B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A33B.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\A416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A416.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\A4D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"
        65⤵
        Executes dropped EXE
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\A5AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"
        66⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\A687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A687.tmp"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\A733.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A733.tmp"
        68⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\A7FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\A8F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"
        70⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\A9A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"
        71⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\AA50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA50.tmp"
        72⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\AB1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"
        73⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\ABF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"
        74⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\ACB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"
        75⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\AD8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"
        76⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\AE57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE57.tmp"
        77⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\AF32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF32.tmp"
        78⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\AFDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"
        79⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\B0B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"
        80⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\B193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B193.tmp"
        81⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\B26E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B26E.tmp"
        82⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\B329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B329.tmp"
        83⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\B404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B404.tmp"
        84⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\B4C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"
        85⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\B59A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B59A.tmp"
        86⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\B646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B646.tmp"
        87⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\B7DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"
        89⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\B898.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B898.tmp"
        90⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\B953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B953.tmp"
        91⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\BA0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"
        92⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\BAEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"
        93⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\BB86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB86.tmp"
        94⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\BC41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC41.tmp"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\BD0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"
        96⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\BDC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"
        97⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\BE93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE93.tmp"
        98⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\BF4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"
        99⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\C01A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C01A.tmp"
        100⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\C114.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C114.tmp"
        101⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\C1DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"
        102⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\C2AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"
        103⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\C366.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C366.tmp"
        104⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\C431.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C431.tmp"
        105⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\C4EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"
        106⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\C5A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"
        107⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\C673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C673.tmp"
        108⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\C70F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70F.tmp"
        109⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\C7CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"
        110⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\C8A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"
        111⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\C961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C961.tmp"
        112⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\CA1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"
        113⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\CAE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"
        114⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\CBA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"
        115⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\CC8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"
        116⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\CD58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD58.tmp"
        117⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\CE43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE43.tmp"
        118⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\CEFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"
        119⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\CFBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"
        120⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\D085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D085.tmp"
        121⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\D131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D131.tmp"
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\D1EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"
        123⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\D289.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D289.tmp"
        124⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\D354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D354.tmp"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\D41F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D41F.tmp"
        126⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\D509.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D509.tmp"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\D5B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"
        128⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\D680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D680.tmp"
        129⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\D74B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D74B.tmp"
        130⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\D826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D826.tmp"
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\D8E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\D9CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"
        133⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\DA87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA87.tmp"
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\DB62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB62.tmp"
        135⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\DC2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"
        136⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\DD37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD37.tmp"
        137⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\DDF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"
        138⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\DE9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"
        139⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\DF5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\E015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E015.tmp"
        141⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\E0C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"
        142⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\E17D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E17D.tmp"
        143⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\E248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E248.tmp"
        144⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\E303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E303.tmp"
        145⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\E3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"
        146⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\E4A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"
        147⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\E574.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E574.tmp"
        148⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\E64F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64F.tmp"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\E6FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"
        150⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\E7C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"
        151⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\E8A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"
        152⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\E96C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E96C.tmp"
        153⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\EA37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA37.tmp"
        154⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\EAF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"
        155⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\EB9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"
        156⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\EC6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"
        157⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\ED44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED44.tmp"
        158⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\EE0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"
        159⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\EECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EECB.tmp"
        160⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\EF86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF86.tmp"
        161⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\F042.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F042.tmp"
        162⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\F0FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"
        163⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\F1B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"
        164⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\F274.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F274.tmp"
        165⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\F330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F330.tmp"
        166⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\F3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\F4A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"
        168⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\F591.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F591.tmp"
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\F64D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F64D.tmp"
        170⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\F708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F708.tmp"
        171⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\F7D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"
        172⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\F88F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F88F.tmp"
        173⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\F96A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F96A.tmp"
        174⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\FA16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA16.tmp"
        175⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\FAD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"
        176⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\FBCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"
        177⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\FC77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC77.tmp"
        178⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\FD32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD32.tmp"
        179⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\FDFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"
        180⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\FEB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"
        181⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\FF94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF94.tmp"
        182⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F.tmp"
        183⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC.tmp"
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\1C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C6.tmp"
        185⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\2B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B1.tmp"
        186⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\34D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D.tmp"
        187⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418.tmp"
        188⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\4D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D4.tmp"
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\59F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F.tmp"
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\66A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66A.tmp"
        191⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\706.tmp"
        192⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\7C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C2.tmp"
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC.tmp"
        194⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\958.tmp"
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\A13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A13.tmp"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACF.tmp"
        197⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8A.tmp"
        198⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\C46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46.tmp"
        199⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D11.tmp"
        200⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\DCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCC.tmp"
        201⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E88.tmp"
        202⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63.tmp"
        203⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\104D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\104D.tmp"
        204⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\10E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10E9.tmp"
        205⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\11C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11C4.tmp"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\1270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1270.tmp"
        207⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\132B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\132B.tmp"
        208⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\13E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13E7.tmp"
        209⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\14C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14C2.tmp"
        210⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\158D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\158D.tmp"
        211⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\1677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1677.tmp"
        212⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\1723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1723.tmp"
        213⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\180D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\180D.tmp"
        214⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\18C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C9.tmp"
        215⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\1994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1994.tmp"
        216⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\1A6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A6F.tmp"
        217⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\1B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"
        218⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\1C15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C15.tmp"
        219⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\1CD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"
        220⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\1D9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\1E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E57.tmp"
        222⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\1F12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F12.tmp"
        223⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\1FBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"
        224⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\2099.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2099.tmp"
        225⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\2183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2183.tmp"
        226⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\223F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\223F.tmp"
        227⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\230A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\230A.tmp"
        228⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\23C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23C5.tmp"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\2481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2481.tmp"
        230⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\252D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\252D.tmp"
        231⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\25F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F8.tmp"
        232⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\26E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26E2.tmp"
        233⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\279E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279E.tmp"
        234⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\2879.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2879.tmp"
        235⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\2953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2953.tmp"
        236⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\2A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"
        237⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\2AEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"
        238⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\2BB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"
        239⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\2C80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C80.tmp"
        240⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\2D5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"
        241⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\2E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E35.tmp"
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\2F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F10.tmp"
        243⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\2FFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FFA.tmp"
        244⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\30C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30C6.tmp"
        245⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\3191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3191.tmp"
        246⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\327B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\327B.tmp"
        247⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\3327.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3327.tmp"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\33F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33F2.tmp"
        249⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\34AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34AE.tmp"
        250⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\3569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3569.tmp"
        251⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\3644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3644.tmp"
        252⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\370F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\370F.tmp"
        253⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\37CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37CA.tmp"
        254⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\3886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3886.tmp"
        255⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\3961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3961.tmp"
        256⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\39FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39FD.tmp"
        257⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\3AC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"
        258⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\3B84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B84.tmp"
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\3C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"
        260⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\3CEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"
        261⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\3DA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DA6.tmp"
        262⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\3E91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E91.tmp"
        263⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\3F4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"
        264⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\4008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4008.tmp"
        265⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\40F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40F2.tmp"
        266⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\418E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418E.tmp"
        267⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\4269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4269.tmp"
        268⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\4334.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4334.tmp"
        269⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\43F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43F0.tmp"
        270⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\44AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44AB.tmp"
        271⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\4596.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4596.tmp"
        272⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\4661.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4661.tmp"
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\471C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\471C.tmp"
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\47F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F7.tmp"
        275⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\48A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48A3.tmp"
        276⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\496E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\496E.tmp"
        277⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\4A1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"
        278⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\4AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"
        279⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\4BA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"
        280⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\4C5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"
        281⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\4D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D37.tmp"
        282⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\4DF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DF2.tmp"
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\4E9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E9E.tmp"
        284⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\4F5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F5A.tmp"
        285⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\5006.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5006.tmp"
        286⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\50D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50D1.tmp"
        287⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\518C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\518C.tmp"
        288⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\5248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5248.tmp"
        289⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\5322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5322.tmp"
        290⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\53DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53DE.tmp"
        291⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\5499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5499.tmp"
        292⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\5565.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5565.tmp"
        293⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\5601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5601.tmp"
        294⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\56EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56EB.tmp"
        295⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\5797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5797.tmp"
        296⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\5853.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5853.tmp"
        297⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\58FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58FE.tmp"
        298⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\59BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59BA.tmp"
        299⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\5A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A66.tmp"
        300⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\5B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B50.tmp"
        301⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\5C0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"
        302⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\5CC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\5D92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D92.tmp"
        304⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\5E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"
        305⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\5F48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F48.tmp"
        306⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\6003.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6003.tmp"
        307⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\60DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60DE.tmp"
        308⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\619A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\619A.tmp"
        309⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\6274.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6274.tmp"
        310⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\6330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6330.tmp"
        311⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\63FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63FB.tmp"
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\64C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C6.tmp"
        313⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\65A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65A1.tmp"
        314⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\666C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\666C.tmp"
        315⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\6747.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6747.tmp"
        316⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\6841.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6841.tmp"
        317⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\68DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68DD.tmp"
        318⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\69B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69B8.tmp"
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\6A73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A73.tmp"
        320⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\6B5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B5E.tmp"
        321⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\6C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C19.tmp"
        322⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\6CC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"
        323⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\6DBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"
        324⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\6E8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E8A.tmp"
        325⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\6F46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F46.tmp"
        326⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\7020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7020.tmp"
        327⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\70CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70CC.tmp"
        328⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\7197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7197.tmp"
        329⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\7224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7224.tmp"
        330⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\72FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72FF.tmp"
        331⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\73BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73BA.tmp"
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\74B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B4.tmp"
        333⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\759F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\759F.tmp"
        334⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\764A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\764A.tmp"
        335⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\7716.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7716.tmp"
        336⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\7800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7800.tmp"
        337⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\78DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78DB.tmp"
        338⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\7977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7977.tmp"
        339⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\7A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A42.tmp"
        340⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\7B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"
        341⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\7BC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"
        342⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\7C84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C84.tmp"
        343⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\7D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D40.tmp"
        344⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\7E0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E0B.tmp"
        345⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\7EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"
        346⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\7F82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F82.tmp"
        347⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\802E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\802E.tmp"
        348⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\80F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80F9.tmp"
        349⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\81E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81E3.tmp"
        350⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\829F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\829F.tmp"
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\836A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\836A.tmp"
        352⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\8425.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8425.tmp"
        353⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\8500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8500.tmp"
        354⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\85BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85BC.tmp"
        355⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\8677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8677.tmp"
        356⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\8733.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8733.tmp"
        357⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\87EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87EE.tmp"
        358⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\889A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\889A.tmp"
        359⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\8965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8965.tmp"
        360⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\8A21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A21.tmp"
        361⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\8AEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"
        362⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\8B98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B98.tmp"
        363⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\8C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C63.tmp"
        364⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\9116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9116.tmp"
        365⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\91D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91D1.tmp"
        366⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\927D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\927D.tmp"
        367⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\9348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9348.tmp"
        368⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\93F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93F4.tmp"
        369⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\94A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94A0.tmp"
        370⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\956B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\956B.tmp"
        371⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\9607.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9607.tmp"
        372⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\96C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96C3.tmp"
        373⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\97AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97AD.tmp"
        374⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\9869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9869.tmp"
        375⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\9924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9924.tmp"
        376⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\99C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99C1.tmp"
        377⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\9A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"
        378⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\9B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B76.tmp"
        379⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\9C32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C32.tmp"
        380⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\9CDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"
        381⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\9D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D99.tmp"
        382⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\9E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E35.tmp"
        383⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\9F00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F00.tmp"
        384⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\9FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FAC.tmp"
        385⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\A077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A077.tmp"
        386⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\A133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A133.tmp"
        387⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\A1FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"
        388⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\A2C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"
        389⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\A385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A385.tmp"
        390⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\A450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A450.tmp"
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\A4FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4FC.tmp"
        392⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\A5B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5B7.tmp"
        393⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\A673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A673.tmp"
        394⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\A71E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A71E.tmp"
        395⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\A7DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7DA.tmp"
        396⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\A895.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A895.tmp"
        397⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\A951.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A951.tmp"
        398⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\A9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9FD.tmp"
        399⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\AAB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAB8.tmp"
        400⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\AB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB74.tmp"
        401⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\AC3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC3F.tmp"
        402⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\AD0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD0A.tmp"
        403⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\ADD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADD5.tmp"
        404⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\AE91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE91.tmp"
        405⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\AF3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF3D.tmp"
        406⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\B017.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B017.tmp"
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\B0E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0E2.tmp"
        408⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\B19E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B19E.tmp"
        409⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\B279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B279.tmp"
        410⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\B382.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B382.tmp"
        411⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\B43E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B43E.tmp"
        412⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\B519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B519.tmp"
        413⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\B5E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E4.tmp"
        414⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\B6BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6BE.tmp"
        415⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\B77A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B77A.tmp"
        416⤵
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\B845.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B845.tmp"
        417⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\B93F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B93F.tmp"
        418⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\B9FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9FB.tmp"
        419⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\BAD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAD5.tmp"
        420⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\BB91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB91.tmp"
        421⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\BC4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4C.tmp"
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\BD08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD08.tmp"
        423⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\BDC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"
        424⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\BE7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"
        425⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\BF5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF5A.tmp"
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\C015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C015.tmp"
        427⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\C0E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E0.tmp"
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\C19C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C19C.tmp"
        429⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\C276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C276.tmp"
        430⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\C332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C332.tmp"
        431⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\C3FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3FD.tmp"
        432⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\C507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C507.tmp"
        433⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\C630.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C630.tmp"
        434⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\C70A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70A.tmp"
        435⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\C7F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7F5.tmp"
        436⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\C8CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8CF.tmp"
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\C9C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9C9.tmp"
        438⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\CAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB4.tmp"
        439⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\CBAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBAE.tmp"
        440⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\CC79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC79.tmp"
        441⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\CD73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD73.tmp"
        442⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\CE2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE2E.tmp"
        443⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\CF28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF28.tmp"
        444⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\D003.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D003.tmp"
        445⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\D0EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0EE.tmp"
        446⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\D1C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1C8.tmp"
        447⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\D293.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D293.tmp"
        448⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\D37E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D37E.tmp"
        449⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\D459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D459.tmp"
        450⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\D543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D543.tmp"
        451⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\D62D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D62D.tmp"
        452⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\D737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D737.tmp"
        453⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\D802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D802.tmp"
        454⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\D8EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8EC.tmp"
        455⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\D9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9B8.tmp"
        456⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\DA92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA92.tmp"
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\DB7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB7D.tmp"
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\DC57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC57.tmp"
        459⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\DD32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD32.tmp"
        460⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\DE0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE0D.tmp"
        461⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\DEF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEF7.tmp"
        462⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\DFD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFD2.tmp"
        463⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\E08E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E08E.tmp"
        464⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\E1A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1A7.tmp"
        465⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\E2A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2A1.tmp"
        466⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\E38B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E38B.tmp"
        467⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\E4A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"
        468⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\E57F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E57F.tmp"
        469⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\E64A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64A.tmp"
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\E715.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E715.tmp"
        471⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\E7D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7D1.tmp"
        472⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\E8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8CB.tmp"
        473⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\E9B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9B5.tmp"
        474⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\EAA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAA0.tmp"
        475⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\EB8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB8A.tmp"
        476⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\EC55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC55.tmp"
        477⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\ED6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED6E.tmp"
        478⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\EE78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE78.tmp"
        479⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\EF53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF53.tmp"
        480⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\F01E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F01E.tmp"
        481⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\F108.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F108.tmp"
        482⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\F1D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1D3.tmp"
        483⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\F2AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2AE.tmp"
        484⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\F389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F389.tmp"
        485⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\F483.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F483.tmp"
        486⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\F55E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F55E.tmp"
        487⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\F629.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F629.tmp"
        488⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\F6E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6E4.tmp"
        489⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\F7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7A0.tmp"
        490⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\F88A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F88A.tmp"
        491⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\F975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F975.tmp"
        492⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\FA6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA6F.tmp"
        493⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\FB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB49.tmp"
        494⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\FC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC24.tmp"
        495⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\FCFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCFF.tmp"
        496⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\FDDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDDA.tmp"
        497⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\FEE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEE3.tmp"
        498⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\FF9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF9F.tmp"
        499⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99.tmp"
        500⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\173.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\173.tmp"
        501⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\24E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24E.tmp"
        502⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\329.tmp"
        503⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\404.tmp"
        504⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\4DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DE.tmp"
        505⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\59A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59A.tmp"
        506⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\675.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\675.tmp"
        507⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\76F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76F.tmp"
        508⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\849.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\849.tmp"
        509⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\924.tmp"
        510⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\9EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF.tmp"
        511⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\ADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADA.tmp"
        512⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\BB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB4.tmp"
        513⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\C8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8F.tmp"
        514⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5A.tmp"
        515⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E35.tmp"
        516⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F10.tmp"
        517⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBC.tmp"
        518⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\1077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1077.tmp"
        519⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\1142.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1142.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\120D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\120D.tmp"
        521⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\12D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12D9.tmp"
        522⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\1394.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1394.tmp"
        523⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\146F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\146F.tmp"
        524⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\1559.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1559.tmp"
        525⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\1615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1615.tmp"
        526⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\16E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16E0.tmp"
        527⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\17AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17AB.tmp"
        528⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\1876.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1876.tmp"
        529⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\1941.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1941.tmp"
        530⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\1A1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A1C.tmp"
        531⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\1B16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B16.tmp"
        532⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\1BE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BE1.tmp"
        533⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\1C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C8D.tmp"
        534⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\1D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D58.tmp"
        535⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\1E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E14.tmp"
        536⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\1EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EDF.tmp"
        537⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\1FB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FB9.tmp"
        538⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\2094.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2094.tmp"
        539⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\216F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\216F.tmp"
        540⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\221B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\221B.tmp"
        541⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\22F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22F6.tmp"
        542⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\23B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23B1.tmp"
        543⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\248C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\248C.tmp"
        544⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\2538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2538.tmp"
        545⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\25F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F3.tmp"
        546⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\26AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26AF.tmp"
        547⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\277A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\277A.tmp"
        548⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\2835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2835.tmp"
        549⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\2910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2910.tmp"
        550⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\29CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29CC.tmp"
        551⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\2A68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A68.tmp"
        552⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\2B33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B33.tmp"
        553⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\2BEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BEE.tmp"
        554⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\2CAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CAA.tmp"
        555⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\2D65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D65.tmp"
        556⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\2E31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E31.tmp"
        557⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\2EEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EEC.tmp"
        558⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\2F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F98.tmp"
        559⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\3053.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3053.tmp"
        560⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\30F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30F0.tmp"
        561⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\31AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31AB.tmp"
        562⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\3276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3276.tmp"
        563⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\3332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3332.tmp"
        564⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\33ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33ED.tmp"
        565⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\34A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34A9.tmp"
        566⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\3564.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3564.tmp"
        567⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\3610.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3610.tmp"
        568⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\36CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36CC.tmp"
        569⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\3778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3778.tmp"
        570⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\3843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3843.tmp"
        571⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\38DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38DF.tmp"
        572⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\398B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\398B.tmp"
        573⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\3A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A66.tmp"
        574⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\3B21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B21.tmp"
        575⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\3BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BDD.tmp"
        576⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\3C98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C98.tmp"
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\3D54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D54.tmp"
        578⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\3DFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DFF.tmp"
        579⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\3ECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3ECB.tmp"
        580⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\3F76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F76.tmp"
        581⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\4013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4013.tmp"
        582⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\40DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40DE.tmp"
        583⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\41C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41C8.tmp"
        584⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\4293.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4293.tmp"
        585⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\433F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\433F.tmp"
        586⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\440A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440A.tmp"
        587⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\4504.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4504.tmp"
        588⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\45C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C0.tmp"
        589⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\467B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\467B.tmp"
        590⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\4737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4737.tmp"
        591⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\47F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F2.tmp"
        592⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\489E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\489E.tmp"
        593⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\494A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\494A.tmp"
        594⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\4A15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A15.tmp"
        595⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\4AC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AC1.tmp"
        596⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\4B6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B6D.tmp"
        597⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\4C28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C28.tmp"
        598⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\4D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D03.tmp"
        599⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\4DCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DCE.tmp"
        600⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\4E99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E99.tmp"
        601⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\4F36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F36.tmp"
        602⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\4FE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE2.tmp"
        603⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\509D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\509D.tmp"
        604⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\5159.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5159.tmp"
        605⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\5204.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5204.tmp"
        606⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\52A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52A1.tmp"
        607⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\535C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\535C.tmp"
        608⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\5418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5418.tmp"
        609⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\54D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54D3.tmp"
        610⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\557F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\557F.tmp"
        611⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\562B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\562B.tmp"
        612⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\56E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56E6.tmp"
        613⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\57B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57B2.tmp"
        614⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\587D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\587D.tmp"
        615⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\5929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5929.tmp"
        616⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\59D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59D4.tmp"
        617⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\5A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A90.tmp"
        618⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\5B4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B4B.tmp"
        619⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\5BF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BF7.tmp"
        620⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\5CD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CD2.tmp"
        621⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\5DAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DAD.tmp"
        622⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\5E78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E78.tmp"
        623⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\5F43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F43.tmp"
        624⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\5FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FFF.tmp"
        625⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\60D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60D9.tmp"
        626⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\6185.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6185.tmp"
        627⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\6231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6231.tmp"
        628⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\62ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62ED.tmp"
        629⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\63A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63A8.tmp"
        630⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\6454.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6454.tmp"
        631⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\650F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\650F.tmp"
        632⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\6609.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6609.tmp"
        633⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\66C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66C5.tmp"
        634⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\67A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67A0.tmp"
        635⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\686B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\686B.tmp"
        636⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\6917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6917.tmp"
        637⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\69C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69C3.tmp"
        638⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\6A9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A9D.tmp"
        639⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\6B49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B49.tmp"
        640⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\6BF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BF5.tmp"
        641⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\6CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CB1.tmp"
        642⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\6D6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D6C.tmp"
        643⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\6E28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E28.tmp"
        644⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\6EE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EE3.tmp"
        645⤵
        
        PID:6648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2689.tmp

Path C:\Users\Admin\AppData\Local\Temp\2689.tmp
Size 3.6MB
SHA256 1f470c37b3c72f6c1abc05d5b44dcd084a4e6944d7ea0af86632b505ef903952
MD5 5af5522af862f5e84186b5f81ee0d5e6
SHA1 5be6a078bbad955ae4fc7a8f2e313a052bdaa246
SHA512 69a3b585e047748ea7e48382a7539ab880247f9a358846557fd1ccbd0d0f4fde4ffb92e37066bf6b629ea80e8e598842ab6d1337a5ef54bee6c177b0ba3e134a
SSDEEP 49152:w/OJD4V8SNGEADt7i+/yTukuFGNLrkBirx:EOumSchrSiGdkBirx
TLSH
T12506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\27E1.tmp
Size 3.6MB
SHA256 ce43883a2e54327a02050f7ed99e88c9de162d60fc63a0af06f26b537ae7c280
MD5 eab814c0dd89e4d0f1a35655af041585
SHA1 9de512ffbcbd23ea1ff21c55b63187ddd9ad1b9e
SHA512 8d937b14a495b5e28f03fbbcb886d54524cc358fe72ddb06190d3dad485c0821f764ef3563232063bdf9ee9280224336bfdfc79f8f318b3bfd28de35ddaf5241
SSDEEP 49152:w/OJDKGyBVfwNGEADt7i+/yTukuFGNLrkBirx:EO7mwchrSiGdkBirx
TLSH
T14306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2AB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AB0.tmp
Size 3.6MB
SHA256 e9ba962c302a4c13ebcc3db8a282fb489678ce9c618e60d993fc114f2cb277bb
MD5 d5bfed208dc95a9de87f66cad7f9f53d
SHA1 44a59a69cf6de977e8934eebc46834bfac19a8d0
SHA512 86e22bba2935e91871c0df21765c5347816e1f20595bff88a50c4f5487bb4c62a98c50a4f3cd012e1ca41bc77e1f70635fd3c9c0ff40e1959e0c24797f65cb4f
SSDEEP 49152:w/OJDk3rNGEADt7i+/yTukuFGNLrkBirx:EOy3rchrSiGdkBirx
TLSH
T1F806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2EB7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
Size 3.6MB
SHA256 739a4938f830b27814609deee3ba039bc843da1baa20e12987d62c6857e10b6f
MD5 2d6943284785a58eb0d0aa95abfe8afc
SHA1 8fd045bdf44132d1e281fb761b24b8e1a43300ab
SHA512 57edfdb8f4eba838e785299b39217982f1bcd49df89e672476bbe1845497a87fa3bf18eef6b0f5d69ab8a18a3a09abd633920e7e45590be4dd3d8ffc3233ac57
SSDEEP 49152:w/OJDI77wNGEADt7i+/yTukuFGNLrkBirx:EOMwchrSiGdkBirx
TLSH
T10106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

330C.tmp

Path C:\Users\Admin\AppData\Local\Temp\330C.tmp
Size 3.6MB
SHA256 8a4f48ffd43fcf8e67670c78ba5b209153edcbf505d706dbe286b579299acad6
MD5 d5e1c209677f0dffff6af44f6add4afb
SHA1 faa963f65cccfdf28a747127fb004c152f08e8f5
SHA512 6d42001996f5817805451b5d496e6a3f2a2fc8c349329b85ba63f36ddbd82a1cb611466a5bdfbcb159a6ab69726bff4a6fb7e6b97bbdf58106bfcebbfb08c022
SSDEEP 49152:w/OJDImWIJ0NGEADt7i+/yTukuFGNLrkBirx:EODWE0chrSiGdkBirx
TLSH
T17706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3714.tmp

Path C:\Users\Admin\AppData\Local\Temp\3714.tmp
Size 3.6MB
SHA256 c21252d863d36a296561de64b457985d0b6bbd1977c37e455cb1df3e259b7ebf
MD5 ef9f42ca7944ed71599016d2dd2f9416
SHA1 2de70cd58244aa6459f7ea8f1b11ccbb55f1aa4d
SHA512 5de83f7168e03d2f8405141fca81e8bbafae275a7d5dde55771dbd0cc69618322e42de47a09d7f26d6a2838545d9cac4aa79cc1a3f1f172a2fc743b277dac694
SSDEEP 24576:wUQOJDveR9eQNGEAFC5etW0Ri+aMyFH1K/PkuRe8GNLJhkBir2ZPevL:w/OJD4NGEADt7i+/yTukuFGNLrkBirx
TLSH
T1E106931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\39E2.tmp
Size 3.6MB
SHA256 210a3635d7dd81f2d0c5ee65e9a43608606e2f568bb894c33837c44f78c98434
MD5 297949cfd0e6146830552a313c9a57a4
SHA1 d46163ffab21cb09f94b19f2d18e5664f3640d37
SHA512 a82b1f5191a3819b14b16c8fc1bc56f5e5e28ec362f5a8831e07c987eb48ba856b9fbd546cb47269b0c0d9b6ed8f0586d7def586dab5ed3974ee4353d2a2cc89
SSDEEP 49152:w/OJDG5mZOV6DlDNGEADt7i+/yTukuFGNLrkBirx:EOIkZjVchrSiGdkBirx
TLSH
T19206831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3D6D.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D6D.tmp
Size 3.6MB
SHA256 45d51247ae64d5ed9c6f368410a42c0f74ad48b236ff4b341316d24f3977c746
MD5 f6a21d5cefb57362150aa549a41d344f
SHA1 8e4964c4469af7e548b610976b172c962f926317
SHA512 07193c8cf885d38179395d47efc0327b3a1dbea1ba90226a8ff30eb670e52f12137afe728a5cc766df8a1f6f564cbe312b8da548a6a12120f3f42cb076353090
SSDEEP 49152:w/OJDyfKhQek9NGEADt7i+/yTukuFGNLrkBirx:EOcqG9chrSiGdkBirx
TLSH
T13606831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EF3.tmp
Size 3.6MB
SHA256 7f41e9615c451cb612f3bc8f4caa052d6f857bace833c850d6d6f40b4e37829a
MD5 4611b13207e66f678ba0e9a32b23c928
SHA1 9c6bd4bded3f132f12c49403abfbf4701bed95f3
SHA512 8f3339588053fa4897adccad4da012260a9e0503617e3e18266f0ad932d3606f208336b7b27c65b1e8e547d68dc769ae4f1c06a2ace65cc4b4ab923c047e0bfa
SSDEEP 49152:w/OJD67zpDceOCPOvNGEADt7i+/yTukuFGNLrkBirx:EOOzpD/TgchrSiGdkBirx
TLSH
T14406831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\42EB.tmp
Size 3.6MB
SHA256 b07150bc6cef4514ac68bc45b84d5cb082ad4f2813e0e34a067045cb19a3da49
MD5 2000d6b56e2e0bd5e2948c4c63938b2f
SHA1 c233e10eb006aa8ba63f24e1e25aadb43bdb47f4
SHA512 b492c66516fc066c32a069a2746cbc3bb467f08f5a8552a0872d9324027775b7133bfa0c4004df044a01a2889acada25800be2e45c608a76096dfe996bb4c286
SSDEEP 49152:w/OJDbuN7j3NGEADt7i+/yTukuFGNLrkBirx:EO2jchrSiGdkBirx
TLSH
T1AD06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4627.tmp

Path C:\Users\Admin\AppData\Local\Temp\4627.tmp
Size 3.6MB
SHA256 bda10c2b91b6448a5f554bab2d661e33a07cc5acaf59703173397491fe2b3ffd
MD5 cbf6bdaf28ee3d984c4b8d0b476f5d81
SHA1 fcfb8961dc09be51033bc7f53d79bdffbf9b2d24
SHA512 f6642c38704aa86a5e5770353340a9f296a2ce734758be9e468e245a3e3dc30267572ed3f7a5ff32a99f3f45f3e98dd28f74eca47558d93f6c0cac89ab8705eb
SSDEEP 49152:w/OJDWhLglr4qdGNGEADt7i+/yTukuFGNLrkBirx:EOh5cchrSiGdkBirx
TLSH
T1AF06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4934.tmp

Path C:\Users\Admin\AppData\Local\Temp\4934.tmp
Size 3.6MB
SHA256 bbd10a52ebe4fef6aa2231f78145580eebbb80d5951092281311b9f9b8e01886
MD5 50d7f2cffab8640099456bdc67900b90
SHA1 f2cb41da723b7562399614254a8bcd08ba11c07e
SHA512 049731d807c18130df1dd9c58aee0143e1c3fadc92a40db534eb841cfab089229f780d9ecd504e67e0e1a3c3768faddb71769cbaae2feeb6eb40e1d3c815575e
SSDEEP 49152:w/OJDNRI9+CNGEADt7i+/yTukuFGNLrkBirx:EOKACchrSiGdkBirx
TLSH
T1C706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4C03.tmp

Path C:\Users\Admin\AppData\Local\Temp\4C03.tmp
Size 3.6MB
SHA256 baa15d162cb0856971ae8eb1c6d3d68d3bad0727a23053f872defc0d236efa36
MD5 137de21f03df0615c0def6a92acdc629
SHA1 684b2f4cc97a0ec3988468d7043d1f0da00c13ca
SHA512 59947e3c7bd380dbab86eace6993333553bd3f9d793e5292889a85cef80c3e85f07502eecd0606138a1baab1f61c73b4aed1527c7df49e1284c051735fb5ce64
SSDEEP 49152:w/OJDjSrWgWhNGEADt7i+/yTukuFGNLrkBirx:EOFIGchrSiGdkBirx
TLSH
T16206931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5049.tmp

Path C:\Users\Admin\AppData\Local\Temp\5049.tmp
Size 3.6MB
SHA256 f1d322167633d8f036e50f905d003a92b2b35095e92466f12fa31be6273b7b0a
MD5 0aa51c11ce37f799f9efc10df997c376
SHA1 27cc37573f68bda015215b12430b9ecbaa8b2bdc
SHA512 a7d9ebabefcc8befb0d4d0a643569d76c70a29f78a190fed50ce34c7bd3ea2a5c976d4a1caf839178670b1739aebc911f22546e6ec940a132b1e4fd9e716d1d2
SSDEEP 49152:w/OJDqvxiUNGEADt7i+/yTukuFGNLrkBirx:EO8vx/chrSiGdkBirx
TLSH
T1CD06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5308.tmp

Path C:\Users\Admin\AppData\Local\Temp\5308.tmp
Size 3.6MB
SHA256 f4bf40b3b881363fe6b71ce701a520c4f0a3bb97ad249c5a8931d1366bc0caa3
MD5 b8184844ea74416bd8070db963d26767
SHA1 b79d37bce31acd8e7ac05cbdf36cf12b1194daf3
SHA512 674632969b524ccc01f153c1efde63e93ede051dc97b94dc838a6a47ecbc268dc9dbb5bbdebffd910bc5e1ca7abe0f9fcfe8206d07d8c5cd5d83d115279bb14e
SSDEEP 49152:w/OJDhBh12LkNNGEADt7i+/yTukuFGNLrkBirx:EOFyLSchrSiGdkBirx
TLSH
T14006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5644.tmp

Path C:\Users\Admin\AppData\Local\Temp\5644.tmp
Size 3.6MB
SHA256 87c8f8e07d280606b8ea7bee05eba8e750b082649e081e92d3f668cc9fdb6392
MD5 3bc15b8cf6ef6a731a085af8736063bf
SHA1 fbff16fafe160a9a7f7c92538d654b60d5504032
SHA512 5c412df5e56c936df351ba1a77f33ad9eb289e797349099dfc130392f5242b37c9700a00c912c3b8e6e474a6863cb9cc546d4685525e37465646f6d04dbdcdfd
SSDEEP 49152:w/OJDuleTayndNGEADt7i+/yTukuFGNLrkBirx:EO0leT5ndchrSiGdkBirx
TLSH
T1DC06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5942.tmp

Path C:\Users\Admin\AppData\Local\Temp\5942.tmp
Size 3.6MB
SHA256 f3aea1055751f46d4748a33d432e1faa523a581de44a2b914dc5dd39718ed37a
MD5 0f8af1e130f6b6aa24304cc88dab1d2b
SHA1 308208764ceba1cea620f5dce249c8ee068c989c
SHA512 62455a284b06f9bf6f5612b09ad64b1aaa771d88aae7cc6f20dd9c3717a0045f9a9e4e90b4d9f83c4e66437ee8486bcb8efb6df9728a63f2a0265e7cf03efd00
SSDEEP 49152:w/OJDjMgs9RnyNGEADt7i+/yTukuFGNLrkBirx:EOBZchrSiGdkBirx
TLSH
T1A006931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5C30.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C30.tmp
Size 3.6MB
SHA256 3a222d3f7ec98d4d386c1650323031e736a139e7ffac828c6e1d44884e3b91d9
MD5 f246be4a45e36b608a77e8ab6681082c
SHA1 23431b67021ea86fcd26efbf5595f760db5804ea
SHA512 403ebf177fa8e97512cb2d510a87962d76c671ca59e6eddf07774c9aee4218adcdfa2b38ced4f8ae973d21985eaf6cfccd9d4c46dc007bded585ce248841e3df
SSDEEP 49152:w/OJDGxNGEADt7i+/yTukuFGNLrkBirx:EO6chrSiGdkBirx
TLSH
T17C0693113BFAC635F2BF8B316EB2E694197BF9629D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5EDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EDF.tmp
Size 3.6MB
SHA256 7df1b839f99eaa971f6312eb21d63c07e4ad09ff9c34dc99668212841ec6aa17
MD5 d7fd2e5f6abb4164b884d4852b9ef376
SHA1 7ab2c3911a5d03f6ceb7ec0378147eb2d2d755eb
SHA512 61a1a83df6c2e5483e7d79b4ce5d40a71e920fc072648ac1d40e2031e3d1c6dd77b9d52e2dd09d3def5e187939fb839798b053650e059112bde3f91aad80e7fd
SSDEEP 49152:w/OJDVHcs3ZHHWTvNGEADt7i+/yTukuFGNLrkBirx:EOgs3ZnWTvchrSiGdkBirx
TLSH
T14D06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

620C.tmp

Path C:\Users\Admin\AppData\Local\Temp\620C.tmp
Size 3.6MB
SHA256 21e81f0210893e7db21b7f04922f20bbb9a2477c412c9f4b54823fabd292a340
MD5 79bbb7dd0d5a67594590156bdb802db5
SHA1 8bd492b53489c8bcefd66ce3f8fef69cc0fbe9d6
SHA512 ef0368bc0dde04597c8ac7ab6cdbc8299d437b638dc9f7f7b83bf5942c15ddc45a6579e589f27a1d2761dd73bc0c605db8cb0646da2ae3cfac37faeeec073484
SSDEEP 49152:w/OJD9V3duQNGEADt7i+/yTukuFGNLrkBirx:EOnZ4QchrSiGdkBirx
TLSH
T18B06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

646D.tmp

Path C:\Users\Admin\AppData\Local\Temp\646D.tmp
Size 3.6MB
SHA256 d81f0d0baf1580bfe3625c393486c783b60db6208ced87440919a8b1898bf477
MD5 15f65664962297e2e32950fddcf06209
SHA1 5847f8e73bf0167fedea00e2c5ac74dc250784ee
SHA512 fb2e2c4d329c6323a3902558196757374f9bfe599e6b52ebc0c09aad7a5b9285b841a8a91c4fee4c7a5b13a48d2e276ddb34719337d4507e87b46b8f23b4659d
SSDEEP 49152:w/OJDQF6UjXNGEADt7i+/yTukuFGNLrkBirx:EO6FLTchrSiGdkBirx
TLSH
T16A06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

678A.tmp

Path C:\Users\Admin\AppData\Local\Temp\678A.tmp
Size 3.6MB
SHA256 006817b740db3be7ba88fe5b4bf3857642113ec35694082fa92c3b900bbf9d07
MD5 8a5260ee2c84fec01d52714d6573a9cb
SHA1 78c1a81e54e3976d53e5ce3047e397eec2be63f8
SHA512 b43960badf96fa1ef91604fe04a7bb921c468493a5397c4b53599225c41ee0ffd989ce585ad3c82971746af26eeddeb0d5201fc7a9edcd38f55c0625ce0a137f
SSDEEP 49152:w/OJDIwd/n1TOuGPdNGEADt7i+/yTukuFGNLrkBirx:EOHpnROuGVchrSiGdkBirx
TLSH
T18206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B24.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B24.tmp
Size 3.6MB
SHA256 40ece3f5854e88008d8ec08827fa208f00534a7c4a4a15c7e00c6f3411a495ab
MD5 1805025b8508b5ff8223e0915cc15457
SHA1 9a1a2cce65ded9c94e0da6058b835c6bb1cfe6dd
SHA512 b72e8b638c685498d520a9bd6c1fb47b65532e3fca55c30457257abea36a193795e32bc64a8ceda3121ce6d2c9bcb22716bd420be8eb557ac4ecd64a592315ec
SSDEEP 49152:w/OJDBXIvfbXvwNGEADt7i+/yTukuFGNLrkBirx:EOwschrSiGdkBirx
TLSH
T16506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6E21.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E21.tmp
Size 3.6MB
SHA256 7da745eb15979e2b267e330c746ba20f182712506b13e3be91d30a513909f077
MD5 6388a20de8186e2a2b71a57bba7c5928
SHA1 77f7080713a731d5120c5f17e1fbb0ab30aeafdc
SHA512 1b5abba44a0622d009f98461277f42683cce8e0544f5fd86ee73544c65bbb584e721f1726999cc30f6fa189fe0b13f2ab6350e7285a0c312580573d108a484e5
SSDEEP 49152:w/OJDT01QhNGEADt7i+/yTukuFGNLrkBirx:EOt0CchrSiGdkBirx
TLSH
T16706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

711F.tmp

Path C:\Users\Admin\AppData\Local\Temp\711F.tmp
Size 3.6MB
SHA256 3540d73e31ea109e74d4fea28ac88052815b3c40cb5f06fb725650a6fe218202
MD5 b4c47a187e232a811d816d294fc87cc9
SHA1 7c30198f2bdf520dd5d467ba4383a0eb19f498bd
SHA512 368805855169d797c6deba37910dda64aea5f5d657c7ca5c2efe3e85944ca5bc10ee7d5387885dde1a461adebf7cc0b268920fe879d01040bffa4c7de69321db
SSDEEP 49152:w/OJD0SNGEADt7i+/yTukuFGNLrkBirx:EOiSchrSiGdkBirx
TLSH
T18606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

748A.tmp

Path C:\Users\Admin\AppData\Local\Temp\748A.tmp
Size 3.6MB
SHA256 313871295146613e4c68dd29f823bd541ac85f01579d769a8a7101093f62af6f
MD5 e55d18c28c0bf1b0e196ab4bbd83364c
SHA1 189df742b8a21b58b5579ac146c8fe4216b6ef51
SHA512 8f7bb7607b9f8e45aecbbb5658e05214eac7e3650db5571dff4edb798b0581cb028f648af4bd9f3ca2175d603e9ec4d7ba22b6559f136cdf1b5039f1bd23f02b
SSDEEP 49152:w/OJDnYt0/o0gpCNGEADt7i+/yTukuFGNLrkBirx:EOZYtghgpCchrSiGdkBirx
TLSH
T1DC06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7788.tmp

Path C:\Users\Admin\AppData\Local\Temp\7788.tmp
Size 3.6MB
SHA256 69f04a975712993d9164d834dbe53b870b3be76ab6f6b53885d4449c6334ebc8
MD5 3da11add79f71012946828bcd705efb3
SHA1 1401378c5ac8055ab2428ad3c43d663be450649a
SHA512 537c0e823397fda0a1bfe3c742f484f1e0001a7756f1123771b94f6a53f82a383580e61640c33876e7669e29942403916d4aa7744b088b8bc067fc3dcb82a6fb
SSDEEP 49152:w/OJDeVud1TfqpPNGEADt7i+/yTukuFGNLrkBirx:EOTlYPchrSiGdkBirx
TLSH
T14006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A08.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A08.tmp
Size 3.6MB
SHA256 e9fb3027d0561e424a803b88d041d68b7bbac2e10610e4dd6adfeee9afb54fb3
MD5 83b68e6f846a5864f1d75b1eeb7964bd
SHA1 4bb42b272384a7e4684983266f5017f0a7100b7b
SHA512 16d95277e5c58e785610b86e69a63b3a020506aa197f7f970bcc34c91e09553f2ef243770a898c0fe68f102ffddd55c60d974141b8938adf2711088b48e62533
SSDEEP 49152:w/OJDkI7YmnLNGEADt7i+/yTukuFGNLrkBirx:EOx5chrSiGdkBirx
TLSH
T10106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D16.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D16.tmp
Size 3.6MB
SHA256 b68175be1c193ad6cb433d6217aea3f2a1257d34f7e8cafb36d13c1a1a4aea68
MD5 46ce0091e26fca6645ef34392e621ade
SHA1 e153be174bb66c1e97101af190a8d712821b5851
SHA512 cf045ed995e57b411dd8467c3bb48524d75fe992150c23c642d2d0701fe8dc46b53d01d6545d120b7feef63dc9fd235050751aa382fb8c620e9f5e556602be6a
SSDEEP 49152:w/OJD60iUefdHJYNGEADt7i+/yTukuFGNLrkBirx:EO4BRGchrSiGdkBirx
TLSH
T10A06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7FD5.tmp

Path C:\Users\Admin\AppData\Local\Temp\7FD5.tmp
Size 3.6MB
SHA256 07d83274e959c6422415d9a0db344a9c9eb232d813b4885c142082faf38fd423
MD5 8955c0c4f84dfae0eee42ad5209ff463
SHA1 53444e3d2e2a47e1f2767a1348e6aac665fefd84
SHA512 0f347808f43fe94e9ba51fbba3f1dd151dccf66e5214ea5fa5d4d17618aec4c57c884d520f8cf8d55ae6e114362375b1340fa4551b31105f26429bc83126940e
SSDEEP 49152:w/OJDcKsYViNGEADt7i+/yTukuFGNLrkBirx:EO22VichrSiGdkBirx
TLSH
T1E706831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8275.tmp

Path C:\Users\Admin\AppData\Local\Temp\8275.tmp
Size 3.6MB
SHA256 697f1aa3df39153874fd187c9525e4a4167324037b3caebb3169d7151bf6a916
MD5 02fb5fa8478d08edec11e6503807e9d5
SHA1 a57587fe437e4fa8bc5d4ed3861d10e49defbafc
SHA512 70b5f7b38dd32b74a9271f880dae0e9fc193745b01a4491057a69d6cc09297c41d94de05157a53d2adcfe0f52dd84575113190bde62e69d12f1fa2673c55364f
SSDEEP 49152:w/OJD8vHJNGEADt7i+/yTukuFGNLrkBirx:EOIpchrSiGdkBirx
TLSH
T16806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8534.tmp

Path C:\Users\Admin\AppData\Local\Temp\8534.tmp
Size 3.6MB
SHA256 de5e3b5d9516f30e152c4c0b5b9ca015c3fe2bfa729d4681e71b657fa6aa8ba2
MD5 77a59b82c3dccce16193369713e7db45
SHA1 6e9d792804be214d14e4f08f195feef269e2e744
SHA512 1aded0c7fe2cf7c54dc1b26e21f5b335f4fe70136112696ed1dbd1b812dd956fa7c1dee1dca40885f73f93d8915d3cd2d91adca174435fb02c85d97110bbca2e
SSDEEP 49152:w/OJDJpjMHs9iNGEADt7i+/yTukuFGNLrkBirx:EOpd9ichrSiGdkBirx
TLSH
T16106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-105-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/204-96-0x0000000000B30000-0x0000000000BB3000-memory.dmp

Download

memory/932-239-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/932-233-0x0000000000D30000-0x0000000000DB3000-memory.dmp

Download

memory/944-201-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/944-208-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/1044-228-0x0000000000CC0000-0x0000000000D43000-memory.dmp

Download

memory/1044-234-0x0000000000CC0000-0x0000000000D43000-memory.dmp

Download

memory/1060-175-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/1060-166-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/1344-69-0x0000000000980000-0x0000000000A03000-memory.dmp

Download

memory/1344-61-0x0000000000980000-0x0000000000A03000-memory.dmp

Download

memory/1484-54-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/1484-62-0x0000000000BB0000-0x0000000000C33000-memory.dmp

Download

memory/1616-21-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/1616-12-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/1796-299-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/1796-294-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/1856-202-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/1856-195-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/2056-133-0x0000000000590000-0x0000000000613000-memory.dmp

Download

memory/2056-124-0x0000000000590000-0x0000000000613000-memory.dmp

Download

memory/2064-26-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/2064-35-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/2168-153-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/2168-145-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/2172-269-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/2172-263-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/2592-76-0x0000000000B70000-0x0000000000BF3000-memory.dmp

Download

memory/2592-68-0x0000000000B70000-0x0000000000BF3000-memory.dmp

Download

memory/2716-0-0x0000000000E30000-0x0000000000EB3000-memory.dmp

Download

memory/2716-5-0x0000000000E30000-0x0000000000EB3000-memory.dmp

Download

memory/2884-160-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/2884-152-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/2992-298-0x0000000000620000-0x00000000006A3000-memory.dmp

Download

memory/3172-278-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/3172-284-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/3292-41-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/3292-33-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/3304-83-0x0000000000BF0000-0x0000000000C73000-memory.dmp

Download

memory/3304-90-0x0000000000BF0000-0x0000000000C73000-memory.dmp

Download

memory/3568-138-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/3568-146-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/3784-258-0x0000000000730000-0x00000000007B3000-memory.dmp

Download

memory/3784-264-0x0000000000730000-0x00000000007B3000-memory.dmp

Download

memory/4112-28-0x0000000000E30000-0x0000000000EB3000-memory.dmp

Download

memory/4112-19-0x0000000000E30000-0x0000000000EB3000-memory.dmp

Download

memory/4116-111-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/4116-103-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/4232-293-0x0000000000E90000-0x0000000000F13000-memory.dmp

Download

memory/4232-288-0x0000000000E90000-0x0000000000F13000-memory.dmp

Download

memory/4244-209-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/4244-216-0x0000000000280000-0x0000000000303000-memory.dmp

Download

memory/4300-117-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/4300-125-0x0000000000660000-0x00000000006E3000-memory.dmp

Download

memory/4468-223-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/4468-215-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/4612-244-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/4612-238-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/4624-55-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/4624-47-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/4732-279-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/4732-273-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/4808-91-0x0000000000710000-0x0000000000793000-memory.dmp

Download

memory/4808-97-0x0000000000710000-0x0000000000793000-memory.dmp

Download

memory/4812-194-0x0000000000550000-0x00000000005D3000-memory.dmp

Download

memory/4812-187-0x0000000000550000-0x00000000005D3000-memory.dmp

Download

memory/4880-167-0x00000000006E0000-0x0000000000763000-memory.dmp

Download

memory/4880-159-0x00000000006E0000-0x0000000000763000-memory.dmp

Download

memory/4892-268-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/4892-274-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/4952-6-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4952-14-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4968-110-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/4968-118-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/5068-229-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/5068-222-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/5080-180-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/5080-173-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/5220-303-0x0000000000FF0000-0x0000000001073000-memory.dmp

Download

memory/5304-188-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/5304-182-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/5492-75-0x0000000000340000-0x00000000003C3000-memory.dmp

Download

memory/5492-82-0x0000000000340000-0x00000000003C3000-memory.dmp

Download

memory/5524-253-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/5524-259-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/5696-131-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/5696-139-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/5744-49-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/5744-42-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/5820-249-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/5820-243-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/5864-248-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/5864-254-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/6052-283-0x00000000007D0000-0x0000000000853000-memory.dmp

Download

memory/6052-289-0x00000000007D0000-0x0000000000853000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads