daad13968b52483a8aa37417bab188d1d184593d079db1d7553138376a47de16

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0ead6392675b6b5e66c4419187879bc5_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260809-cpl9haycpb
SHA256 daad13968b52483a8aa37417bab188d1d184593d079db1d7553138376a47de16
MD5 0ead6392675b6b5e66c4419187879bc5
SHA1 0aea00f3097917afd2f8a003cb59f002689cf5ee
SHA512 7c92413e5b4df7b343618b1b786ee1f1598b2413dbb9077740b12715f3f48a6ea7d99e464034433efbd952660c51d0a950683f5fff4448edcea4855400ddb401
SSDEEP 49152:w/OJDO8WNGEADt7i+/yTukuFGNLrkBirx:EONWchrSiGdkBirx
TLSH
T1B306831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4488	E692.tmp
3416	E7FA.tmp
2900	ED39.tmp
4912	EF2D.tmp
4336	F22B.tmp
2680	F519.tmp
5252	F6EE.tmp
1236	FA78.tmp
1484	FD37.tmp
2608	FFF6.tmp
3400	258.tmp
1136	507.tmp
1664	814.tmp
6000	BCE.tmp
1712	E7D.tmp
124	112D.tmp
3020	13EC.tmp
5932	165D.tmp
5312	196A.tmp
6076	1C29.tmp
1760	1E9A.tmp
2152	212A.tmp
4928	23F9.tmp
4996	2689.tmp
2684	28FA.tmp
3500	2B7B.tmp
5404	2E69.tmp
3936	30DA.tmp
1952	3389.tmp
4968	361A.tmp
708	38C9.tmp
2484	3B59.tmp
4800	3D9C.tmp
2088	3EA5.tmp
5236	3F90.tmp
824	408A.tmp
2248	4174.tmp
2068	423F.tmp
2992	430A.tmp
5144	43F5.tmp
3044	453D.tmp
1396	4646.tmp
2100	4750.tmp
4236	47FC.tmp
2984	4915.tmp
1488	4A0F.tmp
4156	4AEA.tmp
1200	4BD4.tmp
3172	4CED.tmp
4796	4DD8.tmp
5364	4EC2.tmp
4364	4FBC.tmp
3956	5097.tmp
2500	5143.tmp
5016	520E.tmp
3428	52D9.tmp
5356	5395.tmp
5580	546F.tmp
4844	550C.tmp
1184	55C7.tmp
3592	5692.tmp
5968	573E.tmp
5544	5809.tmp
892	58D4.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADDA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF6C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4269.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D41A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DDAF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5990.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A7A0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1D2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47F7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6DDE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9089.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A634.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFA8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C63F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CEFA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83CC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B0D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4D6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2FA8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED39.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA99.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB93.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D77A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F12C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B344.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9AA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F77.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	759F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B910.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FAAD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64AC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4CED.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7611.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D5D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B269.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C6FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D9F6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFF6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4BD4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5143.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F6C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7555.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5257.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7437.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85FA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DD6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	671D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91B7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9FFF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A9DE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACBC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B78A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D2C2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD7A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D920.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39ED.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CFC5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EBC9.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4488	4128	2026-08-09_0ead6392675b6b5e66c4419187879bc5_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4488 wrote to memory of 3416	4488	E692.tmp	90
PID 3416 wrote to memory of 2900	3416	E7FA.tmp	91
PID 2900 wrote to memory of 4912	2900	ED39.tmp	92
PID 4912 wrote to memory of 4336	4912	EF2D.tmp	93
PID 4336 wrote to memory of 2680	4336	F22B.tmp	94
PID 2680 wrote to memory of 5252	2680	F519.tmp	95
PID 5252 wrote to memory of 1236	5252	F6EE.tmp	96
PID 1236 wrote to memory of 1484	1236	FA78.tmp	97
PID 1484 wrote to memory of 2608	1484	FD37.tmp	98
PID 2608 wrote to memory of 3400	2608	FFF6.tmp	99
PID 3400 wrote to memory of 1136	3400	258.tmp	100
PID 1136 wrote to memory of 1664	1136	507.tmp	101
PID 1664 wrote to memory of 6000	1664	814.tmp	102
PID 6000 wrote to memory of 1712	6000	BCE.tmp	103
PID 1712 wrote to memory of 124	1712	E7D.tmp	104
PID 124 wrote to memory of 3020	124	112D.tmp	105
PID 3020 wrote to memory of 5932	3020	13EC.tmp	106
PID 5932 wrote to memory of 5312	5932	165D.tmp	107
PID 5312 wrote to memory of 6076	5312	196A.tmp	108
PID 6076 wrote to memory of 1760	6076	1C29.tmp	109
PID 1760 wrote to memory of 2152	1760	1E9A.tmp	110
PID 2152 wrote to memory of 4928	2152	212A.tmp	111
PID 4928 wrote to memory of 4996	4928	23F9.tmp	112
PID 4996 wrote to memory of 2684	4996	2689.tmp	113
PID 2684 wrote to memory of 3500	2684	28FA.tmp	114
PID 3500 wrote to memory of 5404	3500	2B7B.tmp	115
PID 5404 wrote to memory of 3936	5404	2E69.tmp	116
PID 3936 wrote to memory of 1952	3936	30DA.tmp	117
PID 1952 wrote to memory of 4968	1952	3389.tmp	118
PID 4968 wrote to memory of 708	4968	361A.tmp	119
PID 708 wrote to memory of 2484	708	38C9.tmp	120
PID 2484 wrote to memory of 4800	2484	3B59.tmp	121
PID 4800 wrote to memory of 2088	4800	3D9C.tmp	122
PID 2088 wrote to memory of 5236	2088	3EA5.tmp	123
PID 5236 wrote to memory of 824	5236	3F90.tmp	124
PID 824 wrote to memory of 2248	824	408A.tmp	125
PID 2248 wrote to memory of 2068	2248	4174.tmp	126
PID 2068 wrote to memory of 2992	2068	423F.tmp	127
PID 2992 wrote to memory of 5144	2992	430A.tmp	128
PID 5144 wrote to memory of 3044	5144	43F5.tmp	129
PID 3044 wrote to memory of 1396	3044	453D.tmp	130
PID 1396 wrote to memory of 2100	1396	4646.tmp	131
PID 2100 wrote to memory of 4236	2100	4750.tmp	132
PID 4236 wrote to memory of 2984	4236	47FC.tmp	133
PID 2984 wrote to memory of 1488	2984	4915.tmp	134
PID 1488 wrote to memory of 4156	1488	4A0F.tmp	135
PID 4156 wrote to memory of 1200	4156	4AEA.tmp	136
PID 1200 wrote to memory of 3172	1200	4BD4.tmp	137
PID 3172 wrote to memory of 4796	3172	4CED.tmp	138
PID 4796 wrote to memory of 5364	4796	4DD8.tmp	139
PID 5364 wrote to memory of 4364	5364	4EC2.tmp	140
PID 4364 wrote to memory of 3956	4364	4FBC.tmp	141
PID 3956 wrote to memory of 2500	3956	5097.tmp	142
PID 2500 wrote to memory of 5016	2500	5143.tmp	143
PID 5016 wrote to memory of 3428	5016	520E.tmp	144
PID 3428 wrote to memory of 5356	3428	52D9.tmp	145
PID 5356 wrote to memory of 5580	5356	5395.tmp	146
PID 5580 wrote to memory of 4844	5580	546F.tmp	147
PID 4844 wrote to memory of 1184	4844	550C.tmp	148
PID 1184 wrote to memory of 3592	1184	55C7.tmp	149
PID 3592 wrote to memory of 5968	3592	5692.tmp	150
PID 5968 wrote to memory of 5544	5968	573E.tmp	151
PID 5544 wrote to memory of 892	5544	5809.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ead6392675b6b5e66c4419187879bc5_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ead6392675b6b5e66c4419187879bc5_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\E692.tmp
  "C:\Users\Admin\AppData\Local\Temp\E692.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\E7FA.tmp
    "C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\ED39.tmp
      "C:\Users\Admin\AppData\Local\Temp\ED39.tmp"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\EF2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\F22B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F22B.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\F519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F519.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\F6EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\FA78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA78.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\FD37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD37.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\FFF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\258.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\258.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\507.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\814.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\BCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCE.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\E7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7D.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\112D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\112D.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\13EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13EC.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\165D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\165D.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\196A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\196A.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\1C29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C29.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\1E9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E9A.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\212A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\212A.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\23F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F9.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\2689.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2689.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\28FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28FA.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\2B7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\2E69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E69.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\30DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30DA.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\3389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3389.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\361A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\361A.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\38C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38C9.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\3B59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B59.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\3D9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\3EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\3F90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F90.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\408A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\408A.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\4174.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4174.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\423F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\423F.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\430A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\430A.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\43F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43F5.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\453D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\453D.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\4646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4646.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\4750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4750.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\47FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47FC.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\4915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4915.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\4A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\4AEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\4BD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\4CED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CED.tmp"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\4DD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\4EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\4FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\5097.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5097.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\5143.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5143.tmp"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\520E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\520E.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\52D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D9.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\5395.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5395.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\546F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\546F.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\550C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\550C.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\55C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55C7.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\5692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5692.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\573E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\573E.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\5809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5809.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\58D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58D4.tmp"
        65⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\5990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5990.tmp"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\5A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"
        67⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\5B55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B55.tmp"
        68⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\5C4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"
        69⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\5D1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"
        70⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\5DD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DD6.tmp"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\5EB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"
        72⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\5F6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\6027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6027.tmp"
        74⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\60E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60E3.tmp"
        75⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\619E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\619E.tmp"
        76⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\624A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\624A.tmp"
        77⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\6315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6315.tmp"
        78⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\63E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63E0.tmp"
        79⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\64AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64AC.tmp"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\6586.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6586.tmp"
        81⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\6651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6651.tmp"
        82⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\671D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\671D.tmp"
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\67E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67E8.tmp"
        84⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\68D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68D2.tmp"
        85⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\699D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\699D.tmp"
        86⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\6A59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A59.tmp"
        87⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\6B14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B14.tmp"
        88⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\6BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"
        89⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\6CAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"
        90⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\6D56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D56.tmp"
        91⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\6E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E21.tmp"
        92⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\6EED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EED.tmp"
        93⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\6F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F98.tmp"
        94⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\7054.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7054.tmp"
        95⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\711F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\711F.tmp"
        96⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\71BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71BB.tmp"
        97⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\7277.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7277.tmp"
        98⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\7342.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7342.tmp"
        99⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\73EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73EE.tmp"
        100⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\74B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B9.tmp"
        101⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\7555.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7555.tmp"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\7611.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7611.tmp"
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\76CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76CC.tmp"
        104⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\77A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77A7.tmp"
        105⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\7843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7843.tmp"
        106⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\78EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78EF.tmp"
        107⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\79BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79BA.tmp"
        108⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\7A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A85.tmp"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\7B31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B31.tmp"
        110⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\7BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"
        111⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\7CB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"
        112⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\7E00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E00.tmp"
        113⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\7EBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"
        114⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\7F77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F77.tmp"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\8023.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8023.tmp"
        116⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\80CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80CF.tmp"
        117⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\819A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\819A.tmp"
        118⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\8246.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8246.tmp"
        119⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\8311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8311.tmp"
        120⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\83CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83CC.tmp"
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\8469.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8469.tmp"
        122⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\8505.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8505.tmp"
        123⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\85B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85B1.tmp"
        124⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\866C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\866C.tmp"
        125⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\8718.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8718.tmp"
        126⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\87B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87B4.tmp"
        127⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\888F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\888F.tmp"
        128⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\894B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\894B.tmp"
        129⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\89F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89F6.tmp"
        130⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\8AA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"
        131⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\8B6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"
        132⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\8C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C19.tmp"
        133⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\8CE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"
        134⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\8D90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D90.tmp"
        135⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\8E2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"
        136⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\8ED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ED8.tmp"
        137⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\8F75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F75.tmp"
        138⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\9030.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9030.tmp"
        139⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\910B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\910B.tmp"
        140⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\91B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91B7.tmp"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\9282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9282.tmp"
        142⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\934D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\934D.tmp"
        143⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\93E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E9.tmp"
        144⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\94A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94A5.tmp"
        145⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\9560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9560.tmp"
        146⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\960C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\960C.tmp"
        147⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\96C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96C8.tmp"
        148⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\9783.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9783.tmp"
        149⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\984E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\984E.tmp"
        150⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\9929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9929.tmp"
        151⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\99C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99C5.tmp"
        152⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\9A81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A81.tmp"
        153⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\9B2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"
        154⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\9BE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"
        155⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\9C94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C94.tmp"
        156⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\9D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D40.tmp"
        157⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\9DEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"
        158⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\9EA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"
        159⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\9F53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F53.tmp"
        160⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\9FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\A0CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"
        162⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\A195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A195.tmp"
        163⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\A241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A241.tmp"
        164⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\A2FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"
        165⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\A3C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"
        166⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\A493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A493.tmp"
        167⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\A55E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A55E.tmp"
        168⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\A61A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A61A.tmp"
        169⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\A6D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"
        170⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\A7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\A86B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A86B.tmp"
        172⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\A908.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A908.tmp"
        173⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\A9E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"
        174⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\AA9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"
        175⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\AB79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB79.tmp"
        176⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\AC34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC34.tmp"
        177⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\ACFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"
        178⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\ADDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\AE95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE95.tmp"
        180⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\AF80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF80.tmp"
        181⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\B04B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B04B.tmp"
        182⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\B116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B116.tmp"
        183⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\B1D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\B29D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B29D.tmp"
        185⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\B368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B368.tmp"
        186⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\B443.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B443.tmp"
        187⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\B50E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B50E.tmp"
        188⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\B5D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"
        189⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\B6B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"
        190⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\B7AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"
        191⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\B8B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"
        192⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\B9C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"
        193⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\BAAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"
        194⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\BBB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"
        195⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\BC9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"
        196⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\BD7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\BE74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE74.tmp"
        198⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\BF4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"
        199⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\C01A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C01A.tmp"
        200⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\C0E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"
        201⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\C191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C191.tmp"
        202⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\C27B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C27B.tmp"
        203⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\C366.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C366.tmp"
        204⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\C431.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C431.tmp"
        205⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\C55A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C55A.tmp"
        206⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\C644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C644.tmp"
        207⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\C6FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"
        208⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\C7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"
        209⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\C8D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"
        210⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\C99F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C99F.tmp"
        211⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\CA99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA99.tmp"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\CB93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB93.tmp"
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\CC6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"
        214⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\CD58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD58.tmp"
        215⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\CE33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE33.tmp"
        216⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\CF6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\D056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D056.tmp"
        218⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\D140.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D140.tmp"
        219⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\D20C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D20C.tmp"
        220⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\D2D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"
        221⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\D3A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"
        222⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\D4DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4DA.tmp"
        223⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\D5B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"
        224⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\D680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D680.tmp"
        225⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\D77A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D77A.tmp"
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\D865.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D865.tmp"
        227⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\D920.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D920.tmp"
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\D9EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"
        229⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\DAD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"
        230⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\DBC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"
        231⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\DC6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"
        232⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\DD47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD47.tmp"
        233⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\DE12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE12.tmp"
        234⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\DEFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"
        235⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\DFA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"
        236⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\E073.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E073.tmp"
        237⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\E12F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E12F.tmp"
        238⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\E219.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E219.tmp"
        239⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\E2E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"
        240⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\E3FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"
        241⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\E4D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"
        242⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\E594.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E594.tmp"
        243⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\E65F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E65F.tmp"
        244⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\E72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E72A.tmp"
        245⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\E814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E814.tmp"
        246⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\E8FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"
        247⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\E9D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"
        248⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\EAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"
        249⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\EB7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"
        250⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\EC4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"
        251⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\ED25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED25.tmp"
        252⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\EDF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"
        253⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\EECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EECB.tmp"
        254⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\EF86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF86.tmp"
        255⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\F061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F061.tmp"
        256⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\F12C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F12C.tmp"
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\F217.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F217.tmp"
        258⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\F2D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"
        259⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\F38E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F38E.tmp"
        260⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\F43A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F43A.tmp"
        261⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\F514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F514.tmp"
        262⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\F5D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"
        263⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\F69B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F69B.tmp"
        264⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\F747.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F747.tmp"
        265⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\F822.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F822.tmp"
        266⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\F8FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"
        267⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\F9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"
        268⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\FA93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA93.tmp"
        269⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\FB4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"
        270⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\FC19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC19.tmp"
        271⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\FCF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"
        272⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\FDAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"
        273⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\FE8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"
        274⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\FF65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF65.tmp"
        275⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20.tmp"
        276⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\12A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12A.tmp"
        277⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\1E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E6.tmp"
        278⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\2A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1.tmp"
        279⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\35D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35D.tmp"
        280⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\428.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\428.tmp"
        281⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\4E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E3.tmp"
        282⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\5AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AE.tmp"
        283⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\65A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65A.tmp"
        284⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\735.tmp"
        285⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\800.tmp"
        286⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB.tmp"
        287⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\977.tmp"
        288⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\A42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A42.tmp"
        289⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0D.tmp"
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\BD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD8.tmp"
        291⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\C84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C84.tmp"
        292⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\D21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D21.tmp"
        293⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\DDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDC.tmp"
        294⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E88.tmp"
        295⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\F43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F43.tmp"
        296⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFF.tmp"
        297⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\10BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10BA.tmp"
        298⤵
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\1176.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1176.tmp"
        299⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\1231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1231.tmp"
        300⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\12ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12ED.tmp"
        301⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\13A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13A8.tmp"
        302⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\1464.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1464.tmp"
        303⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\1510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1510.tmp"
        304⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\15BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15BC.tmp"
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\1668.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1668.tmp"
        306⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\1733.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1733.tmp"
        307⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\17FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17FE.tmp"
        308⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\18C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C9.tmp"
        309⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\1984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1984.tmp"
        310⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\1A50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A50.tmp"
        311⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\1B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"
        312⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\1BE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"
        313⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\1CA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"
        314⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\1D5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\1E38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E38.tmp"
        316⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\1F03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F03.tmp"
        317⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\1FCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"
        318⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\20A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20A9.tmp"
        319⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\2164.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2164.tmp"
        320⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\2220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2220.tmp"
        321⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\22DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22DB.tmp"
        322⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\2397.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2397.tmp"
        323⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\2462.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2462.tmp"
        324⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\252D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\252D.tmp"
        325⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\25D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25D9.tmp"
        326⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\26A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26A4.tmp"
        327⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\275F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\275F.tmp"
        328⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\283A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\283A.tmp"
        329⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\28F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28F6.tmp"
        330⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\2992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2992.tmp"
        331⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\2A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"
        332⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\2B28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B28.tmp"
        333⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\2C03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C03.tmp"
        334⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\2CAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"
        335⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\2D5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"
        336⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\2E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E35.tmp"
        337⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\2EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"
        338⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\2F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"
        339⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\3077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3077.tmp"
        340⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\3143.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3143.tmp"
        341⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\31EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31EE.tmp"
        342⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\32AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32AA.tmp"
        343⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\3356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3356.tmp"
        344⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\3421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3421.tmp"
        345⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\34FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34FC.tmp"
        346⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\3598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3598.tmp"
        347⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\3644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3644.tmp"
        348⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\36FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36FF.tmp"
        349⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\37CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37CA.tmp"
        350⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\3886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3886.tmp"
        351⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\3932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3932.tmp"
        352⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\39ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39ED.tmp"
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\3A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A99.tmp"
        354⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\3B55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B55.tmp"
        355⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\3C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"
        356⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\3CEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\3D87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D87.tmp"
        358⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\3E23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E23.tmp"
        359⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\3EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"
        360⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\3FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FAA.tmp"
        361⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\4046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4046.tmp"
        362⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\4102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4102.tmp"
        363⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\41AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41AE.tmp"
        364⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\4269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4269.tmp"
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\4305.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4305.tmp"
        366⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\43B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43B1.tmp"
        367⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\447C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\447C.tmp"
        368⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\4528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4528.tmp"
        369⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\45E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45E4.tmp"
        370⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\4680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4680.tmp"
        371⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\472C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\472C.tmp"
        372⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\47F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F7.tmp"
        373⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\48A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48A3.tmp"
        374⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\496E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\496E.tmp"
        375⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\4A2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"
        376⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\4AE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"
        377⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\4B91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B91.tmp"
        378⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\4C4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"
        379⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\4CE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"
        380⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\4DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"
        381⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\4E40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E40.tmp"
        382⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\4F0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"
        383⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\4FA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"
        384⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\5063.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5063.tmp"
        385⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\5100.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5100.tmp"
        386⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\51BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51BB.tmp"
        387⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\5257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5257.tmp"
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\5303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5303.tmp"
        389⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\53AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AF.tmp"
        390⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\544B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\544B.tmp"
        391⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        392⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\55B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55B3.tmp"
        393⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\565F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\565F.tmp"
        394⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\5739.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5739.tmp"
        395⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\57D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57D6.tmp"
        396⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\5872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5872.tmp"
        397⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\592D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\592D.tmp"
        398⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\59E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59E9.tmp"
        399⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\5AA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA4.tmp"
        400⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\5B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B50.tmp"
        401⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\5BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"
        402⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\5CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"
        403⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\5D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D44.tmp"
        404⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\5DF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DF0.tmp"
        405⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\5EAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EAC.tmp"
        406⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\5F48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F48.tmp"
        407⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\5FF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"
        408⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\60A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60A0.tmp"
        409⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\615B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\615B.tmp"
        410⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\6207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6207.tmp"
        411⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\62D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62D2.tmp"
        412⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\638E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\638E.tmp"
        413⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\6439.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6439.tmp"
        414⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\64D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64D6.tmp"
        415⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\6979.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6979.tmp"
        416⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\6A35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A35.tmp"
        417⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\6AE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AE1.tmp"
        418⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\6B9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"
        419⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\6C58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C58.tmp"
        420⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\6D13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D13.tmp"
        421⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\6DDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\6E8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E8A.tmp"
        423⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\6F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F74.tmp"
        424⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\7020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7020.tmp"
        425⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\70CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70CC.tmp"
        426⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\7178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7178.tmp"
        427⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\7224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7224.tmp"
        428⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\72DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72DF.tmp"
        429⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\738B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\738B.tmp"
        430⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\7437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7437.tmp"
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\74E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74E3.tmp"
        432⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\759F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\759F.tmp"
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\7679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7679.tmp"
        434⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\7716.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7716.tmp"
        435⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\77F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77F0.tmp"
        436⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\789C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\789C.tmp"
        437⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\7948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7948.tmp"
        438⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\79E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79E4.tmp"
        439⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\7A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A90.tmp"
        440⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\7B6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B6B.tmp"
        441⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\7C17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C17.tmp"
        442⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\7CD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CD2.tmp"
        443⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\7D7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"
        444⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\7E3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"
        445⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\7EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"
        446⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\7F91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F91.tmp"
        447⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\804D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\804D.tmp"
        448⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\8108.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8108.tmp"
        449⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\81A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81A5.tmp"
        450⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\8260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8260.tmp"
        451⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\831C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\831C.tmp"
        452⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\83C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83C8.tmp"
        453⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\8493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8493.tmp"
        454⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\853F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\853F.tmp"
        455⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\85FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85FA.tmp"
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\86B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86B6.tmp"
        457⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\8781.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8781.tmp"
        458⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\884C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\884C.tmp"
        459⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\8907.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8907.tmp"
        460⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\89A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89A4.tmp"
        461⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\8A4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"
        462⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\8AEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"
        463⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\8BA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BA7.tmp"
        464⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\8C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C63.tmp"
        465⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\8CFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CFF.tmp"
        466⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\8D9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D9B.tmp"
        467⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\8E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E57.tmp"
        468⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\8F12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F12.tmp"
        469⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\8FBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FBE.tmp"
        470⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\9089.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9089.tmp"
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\9125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9125.tmp"
        472⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\91D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91D1.tmp"
        473⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\928D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\928D.tmp"
        474⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\9339.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9339.tmp"
        475⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\93E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E5.tmp"
        476⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\94B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B0.tmp"
        477⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\956B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\956B.tmp"
        478⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\9627.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9627.tmp"
        479⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\96D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96D3.tmp"
        480⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\978E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\978E.tmp"
        481⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\983A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\983A.tmp"
        482⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\98E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98E6.tmp"
        483⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\99B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99B1.tmp"
        484⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\9A4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A4D.tmp"
        485⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\9AE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"
        486⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\9B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B95.tmp"
        487⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\9C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C51.tmp"
        488⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\9CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"
        489⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\9D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D99.tmp"
        490⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\9E45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E45.tmp"
        491⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\9F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F10.tmp"
        492⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\9FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FBC.tmp"
        493⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\A077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A077.tmp"
        494⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\A123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A123.tmp"
        495⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\A1EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1EE.tmp"
        496⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\A2AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2AA.tmp"
        497⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\A356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A356.tmp"
        498⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\A402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A402.tmp"
        499⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\A4AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"
        500⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\A579.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A579.tmp"
        501⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\A634.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A634.tmp"
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\A6FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6FF.tmp"
        503⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\A79B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A79B.tmp"
        504⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\A857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A857.tmp"
        505⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\A922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A922.tmp"
        506⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\A9DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9DE.tmp"
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\AA99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA99.tmp"
        508⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\AB64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB64.tmp"
        509⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\AC10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC10.tmp"
        510⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\ACBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACBC.tmp"
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\AD68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD68.tmp"
        512⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\AE14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE14.tmp"
        513⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\AEDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEDF.tmp"
        514⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\AF8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF8B.tmp"
        515⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\B027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B027.tmp"
        516⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\B102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B102.tmp"
        517⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\B1CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1CD.tmp"
        518⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\B269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B269.tmp"
        519⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\B344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B344.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\B3D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3D0.tmp"
        521⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\B48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B48C.tmp"
        522⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\B567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B567.tmp"
        523⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\B603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B603.tmp"
        524⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\B6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6CE.tmp"
        525⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\B78A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B78A.tmp"
        526⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\B845.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B845.tmp"
        527⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\B910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B910.tmp"
        528⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\B9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9BC.tmp"
        529⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\BA68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA68.tmp"
        530⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\BB33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB33.tmp"
        531⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\BBEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"
        532⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\BC9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC9A.tmp"
        533⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\BD66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD66.tmp"
        534⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\BE02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE02.tmp"
        535⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\BEEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"
        536⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\BFA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFA8.tmp"
        537⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\C054.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C054.tmp"
        538⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\C11F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C11F.tmp"
        539⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\C1EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1EA.tmp"
        540⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\C2A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2A5.tmp"
        541⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\C380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C380.tmp"
        542⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\C43C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C43C.tmp"
        543⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\C4D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4D8.tmp"
        544⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\C584.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C584.tmp"
        545⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\C63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C63F.tmp"
        546⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\C6FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6FB.tmp"
        547⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\C787.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C787.tmp"
        548⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\C833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C833.tmp"
        549⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\C8EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8EF.tmp"
        550⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\C9AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9AA.tmp"
        551⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\CA66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA66.tmp"
        552⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\CB12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB12.tmp"
        553⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\CB9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB9E.tmp"
        554⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\CC4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC4A.tmp"
        555⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\CCF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCF6.tmp"
        556⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\CDC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDC1.tmp"
        557⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\CE4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE4E.tmp"
        558⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\CEFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEFA.tmp"
        559⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\CFC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFC5.tmp"
        560⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\D071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D071.tmp"
        561⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\D12C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D12C.tmp"
        562⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\D1E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1E8.tmp"
        563⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\D2C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2C2.tmp"
        564⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\D38D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D38D.tmp"
        565⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\D41A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D41A.tmp"
        566⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\D4D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4D6.tmp"
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\D5B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B0.tmp"
        568⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\D67B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D67B.tmp"
        569⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\D727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D727.tmp"
        570⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\D7D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7D3.tmp"
        571⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\D87F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D87F.tmp"
        572⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\D93B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D93B.tmp"
        573⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\D9F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9F6.tmp"
        574⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\DAB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAB2.tmp"
        575⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\DB7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB7D.tmp"
        576⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\DC57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC57.tmp"
        577⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\DD03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD03.tmp"
        578⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\DDAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDAF.tmp"
        579⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\DE6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE6B.tmp"
        580⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\DF17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF17.tmp"
        581⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\DFD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFD2.tmp"
        582⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\E07E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E07E.tmp"
        583⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\E149.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E149.tmp"
        584⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\E1E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1E5.tmp"
        585⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\E2A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2A1.tmp"
        586⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\E36C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E36C.tmp"
        587⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\E427.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E427.tmp"
        588⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\E4E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"
        589⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\E57F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E57F.tmp"
        590⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\E66A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E66A.tmp"
        591⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\E715.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E715.tmp"
        592⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\E7B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7B2.tmp"
        593⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\E86D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E86D.tmp"
        594⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\E909.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E909.tmp"
        595⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\E9C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9C5.tmp"
        596⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\EA71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA71.tmp"
        597⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\EB1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB1D.tmp"
        598⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\EBC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBC9.tmp"
        599⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\EC65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC65.tmp"
        600⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\ED11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED11.tmp"
        601⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\EDCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"
        602⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\EE88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE88.tmp"
        603⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\EF43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF43.tmp"
        604⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\EFFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFFF.tmp"
        605⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\F0BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0BA.tmp"
        606⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\F176.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F176.tmp"
        607⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\F222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F222.tmp"
        608⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\F2CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2CD.tmp"
        609⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\F389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F389.tmp"
        610⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\F444.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F444.tmp"
        611⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\F500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F500.tmp"
        612⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\F5BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5BB.tmp"
        613⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\F667.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F667.tmp"
        614⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\F732.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F732.tmp"
        615⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\F7CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7CF.tmp"
        616⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\F89A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F89A.tmp"
        617⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\F946.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F946.tmp"
        618⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\FA01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA01.tmp"
        619⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\FAAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAAD.tmp"
        620⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\FB78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB78.tmp"
        621⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\FC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC24.tmp"
        622⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\FCD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD0.tmp"
        623⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\FD7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD7C.tmp"
        624⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\FE37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE37.tmp"
        625⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\FEF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEF3.tmp"
        626⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\FFAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFAE.tmp"
        627⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B.tmp"
        628⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\135.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\135.tmp"
        629⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\1D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D1.tmp"
        630⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\28D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D.tmp"
        631⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348.tmp"
        632⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\404.tmp"
        633⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\4A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A0.tmp"
        634⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\55B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55B.tmp"
        635⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617.tmp"
        636⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\6B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3.tmp"
        637⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\75F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75F.tmp"
        638⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\83A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83A.tmp"
        639⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\8D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D6.tmp"
        640⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\992.tmp"
        641⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\A6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6C.tmp"
        642⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\B09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B09.tmp"
        643⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4.tmp"
        644⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70.tmp"
        645⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\D3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3B.tmp"
        646⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE7.tmp"
        647⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\EB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB2.tmp"
        648⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5E.tmp"
        649⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\1019.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1019.tmp"
        650⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\10D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10D5.tmp"
        651⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\1171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1171.tmp"
        652⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\123C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\123C.tmp"
        653⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        654⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\1384.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1384.tmp"
        655⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\1450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1450.tmp"
        656⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\14FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14FB.tmp"
        657⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\15B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15B7.tmp"
        658⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\16A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16A1.tmp"
        659⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\172E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\172E.tmp"
        660⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\17E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17E9.tmp"
        661⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\18B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18B5.tmp"
        662⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\1941.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1941.tmp"
        663⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\19FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19FD.tmp"
        664⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\1A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A99.tmp"
        665⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\1B64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B64.tmp"
        666⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\1C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C2F.tmp"
        667⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\1CDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CDB.tmp"
        668⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\1D87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D87.tmp"
        669⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\1E42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E42.tmp"
        670⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\1EFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EFE.tmp"
        671⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\1FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FAA.tmp"
        672⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\2056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2056.tmp"
        673⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\2102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2102.tmp"
        674⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\21CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21CD.tmp"
        675⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\2269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2269.tmp"
        676⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\2324.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2324.tmp"
        677⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\23E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23E0.tmp"
        678⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\249B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\249B.tmp"
        679⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\2538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2538.tmp"
        680⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\2612.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2612.tmp"
        681⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\26CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26CE.tmp"
        682⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\277A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\277A.tmp"
        683⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\2835.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2835.tmp"
        684⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\2910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2910.tmp"
        685⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\29AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29AC.tmp"
        686⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\2A77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A77.tmp"
        687⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\2B33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B33.tmp"
        688⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\2BCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BCF.tmp"
        689⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\2C7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C7B.tmp"
        690⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\2D56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D56.tmp"
        691⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\2E02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E02.tmp"
        692⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\2ECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ECD.tmp"
        693⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\2FA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:6816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

112D.tmp

Path C:\Users\Admin\AppData\Local\Temp\112D.tmp
Size 3.6MB
SHA256 c0d595076143e0139089b56702fe81690a672e75ec5941001fd7687c8091eef8
MD5 7ecb04aa45455b571bad33e62255a16d
SHA1 d81e012b12ce2d03aa088f042cbcb53df22ccb1a
SHA512 edf5f19eca071403cee5ca0182a200c408566bc301b54e9b65e8e0b13ba4fbc5efbd55ee3e7ad9cf5dfc19d0f56769e78d1b7cfc7f70efda0d05a4840318200f
SSDEEP 49152:w/OJDQhrfNGEADt7i+/yTukuFGNLrkBirx:EOkjchrSiGdkBirx
TLSH
T10706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\13EC.tmp
Size 3.6MB
SHA256 da5e54db0aaea4c66dfab3cce994fdccd94a292021243dc3d0d037aba3927fbb
MD5 5b534f54096e2d436336d2658401414b
SHA1 b9fe7767566270278886f080ed29299046a885f3
SHA512 9d03c01a480b30a147c8d704cb0c7f660689f2904af3381c07e1f8422ed8e11ca511b4c41ff9f568445509ff0d6e1f0b824887f32e3a3594744ac8458a26077b
SSDEEP 49152:w/OJDJr4HLpNGEADt7i+/yTukuFGNLrkBirx:EOL4H9chrSiGdkBirx
TLSH
T17906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

165D.tmp

Path C:\Users\Admin\AppData\Local\Temp\165D.tmp
Size 3.6MB
SHA256 e59d8c6a9233a139e09a625e1301a54e26e90c1c4c09d4ecd6c59ee9d4cc8373
MD5 28fb88691508d4c01ab72fc78de7f741
SHA1 a77a707fd4f99ae86ceaaa1e2dd4e17e2763a80d
SHA512 27cae78b64e1766a388b711607ecfbc955969683bf97a604328911cb997cdf15009f37e6f1a0b659bc77f5b930397d2861b747170e4ef9a692e828bcbda801f5
SSDEEP 49152:w/OJD274weyLNGEADt7i+/yTukuFGNLrkBirx:EO074MLchrSiGdkBirx
TLSH
T1CF06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

196A.tmp

Path C:\Users\Admin\AppData\Local\Temp\196A.tmp
Size 3.6MB
SHA256 24850db388ac8c53fe79d3d22e60c0f1981eb72e3c8b58bdc05dcaf837eb0c4c
MD5 6df26e7570a5558ac43506f53e856796
SHA1 555ffcfa04a50f1a601c4c73c1103dc277d8c5d8
SHA512 2104df6ce678bc186343894861c598f04c3c4c7efbc3b510808d3f9ada1b7096495249f23bbca6354e7fa8ca983c6d3d9325bf00c5b06940232ee1658dc12f10
SSDEEP 49152:w/OJDlG0Hi4ehNGEADt7i+/yTukuFGNLrkBirx:EOTbdehchrSiGdkBirx
TLSH
T14106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1C29.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C29.tmp
Size 3.6MB
SHA256 055c69a0f891123b46681ca8da90612b897101d6e8347ac754ddca50e05e4d76
MD5 b1f69219cd22fa4acb1dbf29c129f9b9
SHA1 e0e4995b1df608d9e2db24edefef8453ed67f2e5
SHA512 cd6fe1d60e5b582c8b50e79e0922cbc900bfe7cde2fea6514a08ebc4abbedb7d988329913da208594873a4c6f4e1bd74e368b30c356034f672910712d79bfb22
SSDEEP 49152:w/OJDfhJrWUNGEADt7i+/yTukuFGNLrkBirx:EOlhJrWUchrSiGdkBirx
TLSH
T1E906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1E9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E9A.tmp
Size 3.6MB
SHA256 bc6a7f0d79fb4c8749de3fbee900de5fc0b5dce7e13134e4cc915a9f41cf9eaf
MD5 31d22f7263e14c9da1a80c5f3e6046f5
SHA1 20b12e71ff9809db90372b076e8e9a2526f596c9
SHA512 ac83fe90d28588466f902359b61ed5dfab410182d728c8eeac885c726b76b0a90727a7c8169563f6bdc81a0667934d84e0ca2591807a003b231568fa08cc667d
SSDEEP 49152:w/OJDaIfNGEADt7i+/yTukuFGNLrkBirx:EO8IfchrSiGdkBirx
TLSH
T11E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

212A.tmp

Path C:\Users\Admin\AppData\Local\Temp\212A.tmp
Size 3.6MB
SHA256 4c5a79e7d05795563e5e14fe1c09476bc12717ba54b86baeee93847e619cc051
MD5 18a22c0214d442e3319fdf312cc97c85
SHA1 cf9de19742e3909c4d8c4f0924b98a2cb9208756
SHA512 48cfa2182f71e892b8134720d19bc57a34ced56e571b925738d009c1cca482fbdf01868dbeac66608679edd94064ca52abb59fdc6f5e1b29136e287ced2a6cc4
SSDEEP 49152:w/OJD4bV1bNGEADt7i+/yTukuFGNLrkBirx:EOynbchrSiGdkBirx
TLSH
T19C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\23F9.tmp
Size 3.6MB
SHA256 012e122765000b0b80480b5bcc83eb5fe05991595d6710a0aba4ebe42267bed6
MD5 4b7c4c8d4d7919cbf9775002e582847b
SHA1 14f9162ddcc21a4fa3078fe0bf914d6b30e4f947
SHA512 f8adec67f73cf5526d6dc8c6b31872f11044b45cfa72bafcbbb58f00cd8703c513f418244dbfcddac5f83d653758eef40b5c775449cb8be122917e2de331d775
SSDEEP 49152:w/OJDvcpQBNGEADt7i+/yTukuFGNLrkBirx:EOZyQBchrSiGdkBirx
TLSH
T1A406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

258.tmp

Path C:\Users\Admin\AppData\Local\Temp\258.tmp
Size 3.6MB
SHA256 13b6dc108e18cecf699ff7b3d642f03e217a336fb917107c7e962ef4031398be
MD5 918c52091d8e9a77de138ccb5c2901db
SHA1 0c276879904e67426a6f933a1a846852e037ff1a
SHA512 9d6c9cb9885a2dfffbf8da613726b08d1b4161f070b2f963f0db8a04dfc63398480a68c1c60e9a697b266238ac2bd2218eafdaae96e2ac6345d4ebdebde4a602
SSDEEP 49152:w/OJDvNDwaNGEADt7i+/yTukuFGNLrkBirx:EOnTchrSiGdkBirx
TLSH
T15A0683113BFAC635F2BF8B356EB2E694197BF9629D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2689.tmp

Path C:\Users\Admin\AppData\Local\Temp\2689.tmp
Size 3.6MB
SHA256 c41a5004be76ad941205855df71b9a814ebf1771aedc31701c1e315d565712a7
MD5 9c106209c0275f168ce8d2c5f8f60e8c
SHA1 9ce91dc53760f15ec59e5ca46786878134b1926d
SHA512 46fbc90bccb002d37bd8f8467a2ff05eeecfb8c8cc76d8b12b33b3eda492e1db2e29240dd58e657cb8eabee946686ca6f2729b4ed8ce90804e607cc21c47188a
SSDEEP 49152:w/OJDq4JkxzWkTNGEADt7i+/yTukuFGNLrkBirx:EOoqkEkTchrSiGdkBirx
TLSH
T16806831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\28FA.tmp
Size 3.6MB
SHA256 c985e9c0d77dff3ea2903e0edf19581b7d68f9a0dc49b56de2e2f32ea2d942bf
MD5 2fe6dcf9c6aabb185651b28f88c54d31
SHA1 43873cfa14781a0db312ef6b8dfd59e191297f50
SHA512 1c2baf310252323ae8c4b835f3c05bf781b50564fc2a26c28dbfd76a904e04ed9e934014376c7fe3f4b6bfcfd4a8d7cd9b8d0e9bbee5f1f89972c534376ce794
SSDEEP 49152:w/OJDYDEgeNGEADt7i+/yTukuFGNLrkBirx:EOyEFchrSiGdkBirx
TLSH
T11C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B7B.tmp
Size 3.6MB
SHA256 3e6293eae7a36e604f14b2855d98fa9e31b7b7daaf464a613e88fe0db38153f3
MD5 f90dbd64685732b546d9ae594dbca30a
SHA1 492a496994df53033146c9db9093b6e404834b42
SHA512 786892d8843bf2c513b4fc5181faad3a58996ea83087c352bc54ea794660eb8b6f80f290cc074b75b9a82724e74b29f5545092d1648b4cd3455a7f5bc1f7814d
SSDEEP 49152:w/OJDb0NGEADt7i+/yTukuFGNLrkBirx:EO+chrSiGdkBirx
TLSH
T1E606931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2E69.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E69.tmp
Size 3.6MB
SHA256 d2a61761deccdfda568bb2ef47db0e08c2e092cf401f08740752792975876032
MD5 c019d72a85a604b475371f82c709051d
SHA1 327513826c4398af9a48640574a25825335f5172
SHA512 f17de497523acaa29c7136fff4514c5198e92ee1f46edd7c9c375a8af5d23bd29d596aa86927dc0dd7ea80ee458189547c393e33c4f83eae7b0d01d7ebedb9f8
SSDEEP 49152:w/OJDoRNSYxNGEADt7i+/yTukuFGNLrkBirx:EOaNVxchrSiGdkBirx
TLSH
T1F306931137FAC635F2BF8B356EB2E654197BF9A2AD51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\30DA.tmp
Size 3.6MB
SHA256 5513472dd7cafe63978d49f588a43cb115ee7cd6ec134d8de31985681ff75f01
MD5 3405c7ee07389d1e612c90dc9a013846
SHA1 9c624ee1bd3b61f7697867a8a1b6e67e42ce129c
SHA512 8baa1a21a76ac5862799fa2ceb7d7edb5e58f13637c14fe9b6079dddcc663528a03d6fefb002c8f2ff5cc6a1a1c9a2c8dc5e27657d4e69fd6b8c5a7e812a10aa
SSDEEP 49152:w/OJDYFEMNGEADt7i+/yTukuFGNLrkBirx:EOichrSiGdkBirx
TLSH
T1D106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3389.tmp

Path C:\Users\Admin\AppData\Local\Temp\3389.tmp
Size 3.6MB
SHA256 ef9532c17c92868c3c925637acf12f2e50474f5467c5b9ab09341d507cc856f7
MD5 944da149895d24036af6edd65573a8de
SHA1 743569acb276df8def917c893130bfb6bdb9d78f
SHA512 688e4cb53a53ccc7b8c75b2aaf7b98a59547987065ca370e40cac171786b943ae67ca24d25f8e425cc97d8521cc6b4321f97c65764c8e0d46f02ab39821280bb
SSDEEP 49152:w/OJDqP+HFRdNGEADt7i+/yTukuFGNLrkBirx:EOIP+lrchrSiGdkBirx
TLSH
T19A06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

361A.tmp

Path C:\Users\Admin\AppData\Local\Temp\361A.tmp
Size 3.6MB
SHA256 cb6bd9668d2c4eb4c6d6b99bb523e1999d1d6d847e7cd6dc939d4a4fc5c3bef5
MD5 a9287ffefe4e60c32b62e69df5f8b755
SHA1 231f11427258f5b38e4637a1aa9d5f5a77d96573
SHA512 c1dbeefd684db3604c0a545dd2c3e5d288c3f53623d959b9529d30a7cb5bc4f6cd0b016b4c1b1480783999bb41fb63cbe1ed5e19974af6fddf68b640fc3a06cf
SSDEEP 49152:w/OJD0X8bNGEADt7i+/yTukuFGNLrkBirx:EOSXAchrSiGdkBirx
TLSH
T10B06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\38C9.tmp
Size 3.6MB
SHA256 6d1b492aa5493db66aee39b9dd6e3800ae4e6c7a15b986bf37b4809624b41488
MD5 cc89661fc97dad29aa7cf46b4538b140
SHA1 e30f072319cc72e781943546d9f654f6b7ca114b
SHA512 ab0b3f07077af3deb4b626ff08dc1ba610c9d8cecd1c59175b2c05390925c1e5547bdefa6d3f4ce2d36dcdaf21b97321c281ef3afa58a0693c2e9db53bf2aeca
SSDEEP 49152:w/OJDVftmwHQONGEADt7i+/yTukuFGNLrkBirx:EOHRHQOchrSiGdkBirx
TLSH
T11F06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B59.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B59.tmp
Size 3.6MB
SHA256 ee688ffc35a3b4da408ed6462073f115c4f27f863e852e0f974072d628897508
MD5 e998de16d9cc2287fff84c193b082f63
SHA1 10106d0c719ab7dafdaa3bc1ed274995ef96a1d3
SHA512 deb0ee14add64e0b23b19b95ef0a0acccc16e776f7fde59204661c55c03d5478bd4c44df22ffdedd6edb2767e26c3ba439b3c4a3fb9ef2c13f48f2c776cfa3b1
SSDEEP 49152:w/OJDYvkgg1xO2NGEADt7i+/yTukuFGNLrkBirx:EOiHg1xzchrSiGdkBirx
TLSH
T18D06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

507.tmp

Path C:\Users\Admin\AppData\Local\Temp\507.tmp
Size 3.6MB
SHA256 54ec2ed50451936b900301f4c8d39eb7fac809e7c91e887b73dfb19b645369fa
MD5 2f53e623ae0fea28a5a3a43b007efffe
SHA1 4fa6bc8482843cefa3a821fe54b5b336b4404e1d
SHA512 3aab6640d0a0a7088dc2277666136ae832987aaf65d17f100c3883a66c32e7732b3b71edfe3495b23e5385d2b7162255c616fcb51c11cb4d400ee56c9f3bb032
SSDEEP 49152:w/OJDWajFNGEADt7i+/yTukuFGNLrkBirx:EOUajFchrSiGdkBirx
TLSH
T11706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

814.tmp

Path C:\Users\Admin\AppData\Local\Temp\814.tmp
Size 3.6MB
SHA256 cd3069c079d0d69ee79f76f5db60279e138231e606ffbc29177245f573e6107f
MD5 99d4f1c73bbe7d424228f0c09baf5734
SHA1 32b9d0c37c7643d8c4d3000fd09f8b4106640480
SHA512 3a08b2d280c52f2bdac8fbdf6490ab04fae57e9f4b1eb3aca851d9da822f81f8e4e560c6f7fc589545ff6822ab9cd669de851ee33db2524e5cba7fe71d7c6c04
SSDEEP 49152:w/OJDBobU2YNGEADt7i+/yTukuFGNLrkBirx:EOvvchrSiGdkBirx
TLSH
T17506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BCE.tmp
Size 3.6MB
SHA256 a37ef11ff8514a993ad6a7ff51ada09d1b8ee8062b239432363d4acc7c4fcf0a
MD5 58bb69a39684ce807ec857f74428740a
SHA1 4cc9c6c0790d0c221ef208ccd9555e6ec83554b1
SHA512 d9d61f06e8219d858544d5ff221c55755f7e5b9852193b04927ca4fc5ddb306da9fd790b5f01e626c9395c1afae87ae57c3b05524e0a2b253168dc95655ef4dd
SSDEEP 49152:w/OJD3M2AzfHNGEADt7i+/yTukuFGNLrkBirx:EOeNzfHchrSiGdkBirx
TLSH
T11306831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E692.tmp

Path C:\Users\Admin\AppData\Local\Temp\E692.tmp
Size 3.6MB
SHA256 510ae5f5242c9df2a1c8385e07d9e995ea860f5a9e4687d9e144d05ce973f1c6
MD5 70924b3dd0f08cca471f0d9c7d1f0087
SHA1 ff6893118d70326cb7f3ab30ee2409cf459b5019
SHA512 3c7bfefa5bc6d7a6e6bf03e9bff1eb82f22394fb3fcd33292d1d4823350fd2927e8c6f831c300749b6091128f3f814f7f076f250f0c290bb040d5c515026d4ea
SSDEEP 49152:w/OJDHd0sqi45NGEADt7i+/yTukuFGNLrkBirx:EOt2sqh5chrSiGdkBirx
TLSH
T13D06831137FAC635F2BF8B316EB2E694197BF962AD51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E7D.tmp
Size 3.6MB
SHA256 333d5628f5e5ac34cc2144888f9394d7fdac2a9fbf110af9666ce8ad6dfe9c32
MD5 6c416f11b8525f1cd8a0b30c9a7aab6f
SHA1 626a8b144a813be1f8adf572fdfa4f148f9589cb
SHA512 61298895f769b55b2dd2c9eaad646ca91933ef92d2083f0edf28f329a05570b8111998fae97e1207d9d46a05b334213f73a4292e7a5e8a20a86d254126aaf86e
SSDEEP 49152:w/OJDEw2XH++NbjNGEADt7i+/yTukuFGNLrkBirx:EOWw2XH+cXchrSiGdkBirx
TLSH
T1E206931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E7FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\E7FA.tmp
Size 3.6MB
SHA256 4b915656520eac6620a4c019fa8b07b04ac9b476708afb0e858d56d33a860271
MD5 6249dc6b771e167e771f5b1184bcb1fd
SHA1 94a8b58d1ae9614ba1be40004a99e116c452dbf0
SHA512 ebf279980720382e3c248127ab887633b5ba159925615b8bd2c9067167e5bb954cf86fabcf62cc969af194fa0fbe5b2e23fb694c0fc81a0ecb76f0e609538a5d
SSDEEP 49152:w/OJD7KNuQUNGEADt7i+/yTukuFGNLrkBirx:EOEUvchrSiGdkBirx
TLSH
T10706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ED39.tmp

Path C:\Users\Admin\AppData\Local\Temp\ED39.tmp
Size 3.6MB
SHA256 ff781c132e817231650260a26f0a67374b6d306e351fce3df14e37f6958999d1
MD5 1270cc6839e593a91e5c75376c8c3138
SHA1 b0551929590ba96669d3a79db55024ce519f81a8
SHA512 1f6d31ede88b2aff0d50deb00b41c39ca6d94d679fb5f4a0b3a880921b124e7874221df5e47c7a478e6586c4ec17f00add8a2db617f151fb0644e1ec56594beb
SSDEEP 49152:w/OJDpnzNGEADt7i+/yTukuFGNLrkBirx:EOTzchrSiGdkBirx
TLSH
T18006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF2D.tmp

Path C:\Users\Admin\AppData\Local\Temp\EF2D.tmp
Size 3.6MB
SHA256 de5ffd78ff20f33c9b4a294ad18519c373af3a02252b563f270af5ea87ce8e01
MD5 a3602f7f2a716111b165fabc701e64c7
SHA1 cfa941082714d8af036aea5693a12129d32658dc
SHA512 6bc3279c3d96881acece3f472497abaf14da0001bbd4b7b2994617241d8bf006ae013784204e5a656a64062454e74db4f34adc79d9059e044cf920b2a3c74a68
SSDEEP 49152:w/OJDYdNSfML4NGEADt7i+/yTukuFGNLrkBirx:EOudNc5chrSiGdkBirx
TLSH
T11006931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F22B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F22B.tmp
Size 3.6MB
SHA256 a51a237074d8799422e49ebbbd5261e650e3ed0e65b0ab52623dd92506d8a7b4
MD5 0731f976bf1c686bb741cc10310571d8
SHA1 fc52adf0a14fada023cea4f7d5b04bb0a5089961
SHA512 d9a4eb1c5a177232b79c4a01867beadabc16bd4c3473f43bc6d97aa3cdc093932e9a5c4b50131770b163f6e36b3fe90ed19dc36ae41831fb27b518910eb0d728
SSDEEP 49152:w/OJDi0gJGVsNGEADt7i+/yTukuFGNLrkBirx:EOULSschrSiGdkBirx
TLSH
T16606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F519.tmp

Path C:\Users\Admin\AppData\Local\Temp\F519.tmp
Size 3.6MB
SHA256 5a69e8424aac67164854a6a3d688011b6877f0318c84724bb4f4aeb6c2bc7a43
MD5 bcefc0e15a6795e20d977791122768c8
SHA1 ca3e7db0f1013d0a8c6b628121876e2099d879b8
SHA512 6dd90c212831d4911428d11b6c3f986bd44d4d518efe468e605588d9247884ab2e6d2358589aa5129f7fa99f0af8a9e000f6c3ede2acf3fd1fe595ea5aa2fd35
SSDEEP 49152:w/OJDY3iiXroNGEADt7i+/yTukuFGNLrkBirx:EOSychrSiGdkBirx
TLSH
T1B106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6EE.tmp
Size 3.6MB
SHA256 a2b787345813d273bb56599c09b44a0c8edbb3165b39a953ad870c7bc7e27a88
MD5 7c83a1c6a0b3925e2c75620e005bf87c
SHA1 92d14f5ce5b2c86bdbb5fa43d0b95e8aa2037bba
SHA512 f357ae6b1dc97098ceb4b97a963d639ae4a91cb9c00a24f5838b5131827f55564d2f08b1d0bc7dfc21b5145a072d161bcc4cdd38e4ed00c145c3fbc49d7e062f
SSDEEP 49152:w/OJD/3IGNGEADt7i+/yTukuFGNLrkBirx:EO13zchrSiGdkBirx
TLSH
T13D06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FA78.tmp

Path C:\Users\Admin\AppData\Local\Temp\FA78.tmp
Size 3.6MB
SHA256 fcc4a9e004d36bead549b2caa5fe473bfa973bcb803b5a5fadea152d8e160e2d
MD5 59532452d91d9b8fadaa840d964706c8
SHA1 de2a25cd501e749c6ce35c42d0a8360eb8baedd4
SHA512 946dd8f295601a11dc4a1e2df2556a8eec23e0854a3e2fec0ad3cefea78867f41c9de0eae9640b754090f49daf562d9a6605e58c300d46c42b65836f5ea610c8
SSDEEP 49152:w/OJDKFc42i7+kNGEADt7i+/yTukuFGNLrkBirx:EOwFcbi7+kchrSiGdkBirx
TLSH
T15106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FD37.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD37.tmp
Size 3.6MB
SHA256 29a153c0e8d7e80fc62ed90313a923bbdca65a9fdb064dfd957dcff28f8fae13
MD5 55b8a5fd47753586d87e29d15298d449
SHA1 a06a6098b059d3e432402ac6e80b42652cba19b0
SHA512 b29aae40b24d102eab28cd9616ec88db3070ae3703a9653a1bd33759b34c45301bf527a82f8edb999b27756bcd5a9ecd6ac16ea5becfd1f357e13a16de75a23e
SSDEEP 49152:w/OJDc6fVoyINGEADt7i+/yTukuFGNLrkBirx:EOXQchrSiGdkBirx
TLSH
T10806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\FFF6.tmp
Size 3.6MB
SHA256 748f2eb6398f2e06dcec5e7d3fa3b626472ccf9be12ed55d15b6a85d398fc47a
MD5 f1a9bb131fd30d22707c2c51a02d5db0
SHA1 773c10e1b4617ddf4e4eb41eb9d9610599475e34
SHA512 48e5103f4452995ea7a0dbd65d909eea3178c09d6e03ed758f19f6264b54da356d54f3a66cc87eca6e851d352e1bead30a4365b7f5517b025fce8fa39e319390
SSDEEP 49152:w/OJDEX4ViUU0NGEADt7i+/yTukuFGNLrkBirx:EOu6DU0chrSiGdkBirx
TLSH
T12306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-110-0x00000000008E0000-0x0000000000963000-memory.dmp

Download

memory/124-119-0x00000000008E0000-0x0000000000963000-memory.dmp

Download

memory/708-224-0x0000000000B00000-0x0000000000B83000-memory.dmp

Download

memory/708-215-0x0000000000B00000-0x0000000000B83000-memory.dmp

Download

memory/824-249-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/824-244-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/1136-83-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/1136-89-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/1200-302-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/1236-61-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/1236-54-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/1396-273-0x0000000000780000-0x0000000000803000-memory.dmp

Download

memory/1484-69-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/1484-62-0x0000000000470000-0x00000000004F3000-memory.dmp

Download

memory/1488-292-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/1488-298-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/1664-96-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/1664-90-0x0000000000050000-0x00000000000D3000-memory.dmp

Download

memory/1712-111-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/1712-103-0x0000000000F80000-0x0000000001003000-memory.dmp

Download

memory/1760-146-0x0000000000E60000-0x0000000000EE3000-memory.dmp

Download

memory/1760-153-0x0000000000E60000-0x0000000000EE3000-memory.dmp

Download

memory/1952-201-0x00000000009C0000-0x0000000000A43000-memory.dmp

Download

memory/1952-209-0x00000000009C0000-0x0000000000A43000-memory.dmp

Download

memory/2068-253-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/2068-259-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/2088-239-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/2088-233-0x0000000000740000-0x00000000007C3000-memory.dmp

Download

memory/2100-278-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/2100-283-0x0000000000030000-0x00000000000B3000-memory.dmp

Download

memory/2152-160-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2152-152-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2248-248-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/2248-254-0x0000000000C80000-0x0000000000D03000-memory.dmp

Download

memory/2484-222-0x00000000005D0000-0x0000000000653000-memory.dmp

Download

memory/2484-229-0x00000000005D0000-0x0000000000653000-memory.dmp

Download

memory/2608-68-0x0000000000190000-0x0000000000213000-memory.dmp

Download

memory/2608-75-0x0000000000190000-0x0000000000213000-memory.dmp

Download

memory/2680-41-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/2680-48-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/2684-173-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/2684-181-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/2900-19-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/2900-26-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/2984-293-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/2984-287-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/2992-258-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/2992-264-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/3020-125-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/3020-117-0x0000000000930000-0x00000000009B3000-memory.dmp

Download

memory/3044-274-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/3044-268-0x0000000000680000-0x0000000000703000-memory.dmp

Download

memory/3400-82-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3400-76-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3416-20-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/3416-12-0x0000000000E00000-0x0000000000E83000-memory.dmp

Download

memory/3500-188-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/3500-180-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/3936-195-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/3936-202-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/4128-0-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/4128-6-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/4156-303-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/4156-297-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/4236-288-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/4236-282-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/4336-40-0x0000000000020000-0x00000000000A3000-memory.dmp

Download

memory/4336-33-0x0000000000020000-0x00000000000A3000-memory.dmp

Download

memory/4488-5-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/4488-14-0x0000000000BA0000-0x0000000000C23000-memory.dmp

Download

memory/4800-234-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/4800-228-0x0000000000DF0000-0x0000000000E73000-memory.dmp

Download

memory/4912-27-0x00000000000E0000-0x0000000000163000-memory.dmp

Download

memory/4912-34-0x00000000000E0000-0x0000000000163000-memory.dmp

Download

memory/4928-159-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/4928-167-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/4968-216-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4968-208-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/4996-175-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/4996-166-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/5144-263-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/5144-269-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/5236-243-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/5236-238-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/5252-47-0x00000000002B0000-0x0000000000333000-memory.dmp

Download

memory/5252-56-0x00000000002B0000-0x0000000000333000-memory.dmp

Download

memory/5312-139-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/5312-132-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/5404-187-0x0000000000490000-0x0000000000513000-memory.dmp

Download

memory/5404-194-0x0000000000490000-0x0000000000513000-memory.dmp

Download

memory/5932-126-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/5932-131-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/6000-105-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/6000-97-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/6076-145-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/6076-138-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads