ec6c8aa563d763e891f39d0433dfbd93d7f46dc64c2c427fa8d0dccbf0e6bb0f

Analysis

max time kernel
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_5c2ccc71ceef56903c53a532eb4a57c1_elex_mafia.exe
Size 520KB
Sample260809-k5wrwavblf
SHA256 ec6c8aa563d763e891f39d0433dfbd93d7f46dc64c2c427fa8d0dccbf0e6bb0f
MD5 5c2ccc71ceef56903c53a532eb4a57c1
SHA1 a6e93fcafc10b8f65eea95919a83a4f254586479
SHA512 3ee1cda6fb097873840a1b216f6aa323798c882a5b2b41062d0c41b67b4ca8d29511f82fdfe30fa620636aab066b3b1910339f3e4cc8f8fc4f58c4032ca85e20
SSDEEP 12288:gj8fuxR21t5i8fvL6aiqLNnDCaJ8DbD5Mp1LVaNZ6:gj8fuK1GYDxRnG1bD5oLcNI
TLSH
T11BB4F012B649C032E5D206309B66EB615BBFBC749B3595CB3B84366D6FB42C1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4548	EFA.tmp
5476	FB6.tmp
864	10EE.tmp
3324	119A.tmp
3340	1294.tmp
3544	136F.tmp
5984	14B7.tmp
4404	15E0.tmp
1364	16CA.tmp
1640	1786.tmp
4652	1880.tmp
3212	192B.tmp
2808	19F7.tmp
1908	1AE1.tmp
1248	1BBC.tmp
4380	1C48.tmp
1776	1D04.tmp
1856	1DB0.tmp
4284	1EAA.tmp
1108	1F36.tmp
3500	2011.tmp
3000	20BD.tmp
264	2188.tmp
2772	2282.tmp
2856	235D.tmp
5216	2438.tmp
5744	2551.tmp
2236	262C.tmp
1212	26E7.tmp
1720	27A3.tmp
3244	288D.tmp
5704	2968.tmp
2832	2A52.tmp
5380	2AFE.tmp
2876	2BAA.tmp
1252	2C75.tmp
4952	2D11.tmp
4320	2DBD.tmp
2564	2E2A.tmp
3416	2ED6.tmp
2256	2FA1.tmp
6096	303E.tmp
3180	30DA.tmp
4172	31A5.tmp
4904	3261.tmp
5812	32DE.tmp
5448	337A.tmp
1668	3416.tmp
5140	34A3.tmp
896	354F.tmp
1748	35EB.tmp
1352	3687.tmp
2160	3743.tmp
2156	37FE.tmp
4844	389A.tmp
2868	3937.tmp
2664	39C3.tmp
5612	3A50.tmp
5952	3B0B.tmp
2180	3BC7.tmp
4800	3C63.tmp
4600	3D2E.tmp
3120	3DBB.tmp
4732	3E67.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBE4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21D1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D89.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C833.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E30E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5673.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A7BF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC48.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E5D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCC7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E792.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3743.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92EF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19C3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A27B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C3DE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E197.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F3A8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A50.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F87.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5AE3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	859C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D2F1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F06C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F6C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B27D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F3FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E95.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB40.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD23.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA9D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5EEF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C191.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF5A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	883C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B2A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F4B2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B88.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8B0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF67.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37FE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B721.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB45.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA0A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA54.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DA4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69F6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4DA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2DBD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A20E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B3D0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4E3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BBC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C48.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C4EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1927.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	563F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F57.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6727.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9F20.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E67.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5346.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4548	2728	2026-08-09_5c2ccc71ceef56903c53a532eb4a57c1_elex_mafia.exe	89
PID 4548 wrote to memory of 5476	4548	EFA.tmp	90
PID 5476 wrote to memory of 864	5476	FB6.tmp	91
PID 864 wrote to memory of 3324	864	10EE.tmp	92
PID 3324 wrote to memory of 3340	3324	119A.tmp	93
PID 3340 wrote to memory of 3544	3340	1294.tmp	94
PID 3544 wrote to memory of 5984	3544	136F.tmp	95
PID 5984 wrote to memory of 4404	5984	14B7.tmp	96
PID 4404 wrote to memory of 1364	4404	15E0.tmp	97
PID 1364 wrote to memory of 1640	1364	16CA.tmp	98
PID 1640 wrote to memory of 4652	1640	1786.tmp	99
PID 4652 wrote to memory of 3212	4652	1880.tmp	100
PID 3212 wrote to memory of 2808	3212	192B.tmp	101
PID 2808 wrote to memory of 1908	2808	19F7.tmp	102
PID 1908 wrote to memory of 1248	1908	1AE1.tmp	103
PID 1248 wrote to memory of 4380	1248	1BBC.tmp	104
PID 4380 wrote to memory of 1776	4380	1C48.tmp	105
PID 1776 wrote to memory of 1856	1776	1D04.tmp	106
PID 1856 wrote to memory of 4284	1856	1DB0.tmp	107
PID 4284 wrote to memory of 1108	4284	1EAA.tmp	108
PID 1108 wrote to memory of 3500	1108	1F36.tmp	109
PID 3500 wrote to memory of 3000	3500	2011.tmp	110
PID 3000 wrote to memory of 264	3000	20BD.tmp	111
PID 264 wrote to memory of 2772	264	2188.tmp	112
PID 2772 wrote to memory of 2856	2772	2282.tmp	113
PID 2856 wrote to memory of 5216	2856	235D.tmp	114
PID 5216 wrote to memory of 5744	5216	2438.tmp	115
PID 5744 wrote to memory of 2236	5744	2551.tmp	116
PID 2236 wrote to memory of 1212	2236	262C.tmp	117
PID 1212 wrote to memory of 1720	1212	26E7.tmp	118
PID 1720 wrote to memory of 3244	1720	27A3.tmp	119
PID 3244 wrote to memory of 5704	3244	288D.tmp	120
PID 5704 wrote to memory of 2832	5704	2968.tmp	121
PID 2832 wrote to memory of 5380	2832	2A52.tmp	122
PID 5380 wrote to memory of 2876	5380	2AFE.tmp	123
PID 2876 wrote to memory of 1252	2876	2BAA.tmp	124
PID 1252 wrote to memory of 4952	1252	2C75.tmp	125
PID 4952 wrote to memory of 4320	4952	2D11.tmp	126
PID 4320 wrote to memory of 2564	4320	2DBD.tmp	127
PID 2564 wrote to memory of 3416	2564	2E2A.tmp	128
PID 3416 wrote to memory of 2256	3416	2ED6.tmp	129
PID 2256 wrote to memory of 6096	2256	2FA1.tmp	130
PID 6096 wrote to memory of 3180	6096	303E.tmp	131
PID 3180 wrote to memory of 4172	3180	30DA.tmp	132
PID 4172 wrote to memory of 4904	4172	31A5.tmp	133
PID 4904 wrote to memory of 5812	4904	3261.tmp	134
PID 5812 wrote to memory of 5448	5812	32DE.tmp	135
PID 5448 wrote to memory of 1668	5448	337A.tmp	136
PID 1668 wrote to memory of 5140	1668	3416.tmp	137
PID 5140 wrote to memory of 896	5140	34A3.tmp	138
PID 896 wrote to memory of 1748	896	354F.tmp	139
PID 1748 wrote to memory of 1352	1748	35EB.tmp	140
PID 1352 wrote to memory of 2160	1352	3687.tmp	141
PID 2160 wrote to memory of 2156	2160	3743.tmp	142
PID 2156 wrote to memory of 4844	2156	37FE.tmp	143
PID 4844 wrote to memory of 2868	4844	389A.tmp	144
PID 2868 wrote to memory of 2664	2868	3937.tmp	145
PID 2664 wrote to memory of 5612	2664	39C3.tmp	146
PID 5612 wrote to memory of 5952	5612	3A50.tmp	147
PID 5952 wrote to memory of 2180	5952	3B0B.tmp	148
PID 2180 wrote to memory of 4800	2180	3BC7.tmp	149
PID 4800 wrote to memory of 4600	4800	3C63.tmp	150
PID 4600 wrote to memory of 3120	4600	3D2E.tmp	151
PID 3120 wrote to memory of 4732	3120	3DBB.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-09_5c2ccc71ceef56903c53a532eb4a57c1_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5c2ccc71ceef56903c53a532eb4a57c1_elex_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\EFA.tmp
  "C:\Users\Admin\AppData\Local\Temp\EFA.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\FB6.tmp
    "C:\Users\Admin\AppData\Local\Temp\FB6.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\10EE.tmp
      "C:\Users\Admin\AppData\Local\Temp\10EE.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\119A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\119A.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\1294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1294.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\136F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\136F.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\14B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14B7.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\15E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15E0.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\16CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16CA.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\1786.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1786.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\1880.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1880.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\192B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\192B.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\19F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19F7.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\1AE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\1BBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\1C48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C48.tmp"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\1D04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D04.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\1DB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\1EAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EAA.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\1F36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F36.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\2011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2011.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\20BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20BD.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\2188.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2188.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\2282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2282.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\235D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\235D.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\2438.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2438.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\2551.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2551.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\262C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\262C.tmp"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\26E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26E7.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\27A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27A3.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\288D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\288D.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\2968.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2968.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\2A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A52.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\2AFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\2BAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\2C75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C75.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\2D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D11.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\2DBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\2E2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\2ED6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\2FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\303E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\303E.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\30DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30DA.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\31A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31A5.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\3261.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3261.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\32DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32DE.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\337A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\337A.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\3416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3416.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\34A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34A3.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\354F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\354F.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\35EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35EB.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\3687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3687.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\3743.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3743.tmp"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\37FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37FE.tmp"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\389A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\389A.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\3937.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3937.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\39C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39C3.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\3A50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A50.tmp"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\3B0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\3BC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\3C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C63.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\3D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\3DBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\3E67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E67.tmp"
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\3F32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F32.tmp"
        66⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\3FDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"
        67⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\407A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\407A.tmp"
        68⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\4107.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4107.tmp"
        69⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\41C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41C2.tmp"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\424F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\424F.tmp"
        71⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\42DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42DB.tmp"
        72⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\4387.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4387.tmp"
        73⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\4452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4452.tmp"
        74⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\44FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44FE.tmp"
        75⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\45C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C9.tmp"
        76⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\4694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4694.tmp"
        77⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\4750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4750.tmp"
        78⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\47EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47EC.tmp"
        79⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\4888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4888.tmp"
        80⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\4954.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4954.tmp"
        81⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\49F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49F0.tmp"
        82⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\4ABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"
        83⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\4B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B76.tmp"
        84⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\4C32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C32.tmp"
        85⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\4CED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CED.tmp"
        86⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\4D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D99.tmp"
        87⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\4E36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E36.tmp"
        88⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\4F01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F01.tmp"
        89⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\4FDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"
        90⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\5097.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5097.tmp"
        91⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\5152.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5152.tmp"
        92⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\521E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\521E.tmp"
        93⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\52BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52BA.tmp"
        94⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\5346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5346.tmp"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\53D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53D3.tmp"
        96⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\546F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\546F.tmp"
        97⤵
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\554A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\554A.tmp"
        98⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\55C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55C7.tmp"
        99⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\5673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5673.tmp"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\571F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\571F.tmp"
        101⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\57DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57DA.tmp"
        102⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\58A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58A5.tmp"
        103⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\5942.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5942.tmp"
        104⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\59CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59CE.tmp"
        105⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\5A5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"
        106⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\5B07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B07.tmp"
        107⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\5BC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"
        108⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\5C6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"
        109⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\5D2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"
        110⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\5D97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D97.tmp"
        111⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\5E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E33.tmp"
        112⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\5EEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\5F9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F9B.tmp"
        114⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\6075.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6075.tmp"
        115⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\6141.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6141.tmp"
        116⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\61EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61EC.tmp"
        117⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\62A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62A8.tmp"
        118⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\6354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6354.tmp"
        119⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\63F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63F0.tmp"
        120⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\647D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\647D.tmp"
        121⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\6538.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6538.tmp"
        122⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\65E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65E4.tmp"
        123⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\6690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6690.tmp"
        124⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\674B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\674B.tmp"
        125⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\6817.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6817.tmp"
        126⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\68E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68E2.tmp"
        127⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\69CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69CC.tmp"
        128⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\6AA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"
        129⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\6B91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B91.tmp"
        130⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\6C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"
        131⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\6CF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"
        132⤵
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\6DC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"
        133⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\6E9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"
        134⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\6F5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"
        135⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\7025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7025.tmp"
        136⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\7100.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7100.tmp"
        137⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\7219.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7219.tmp"
        138⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\7323.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7323.tmp"
        139⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\73EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73EE.tmp"
        140⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\74C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74C9.tmp"
        141⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\7555.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7555.tmp"
        142⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\7630.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7630.tmp"
        143⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\7749.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7749.tmp"
        144⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\77E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E5.tmp"
        145⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\7891.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7891.tmp"
        146⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\795C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\795C.tmp"
        147⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\7A47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A47.tmp"
        148⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\7B31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B31.tmp"
        149⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\7C2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"
        150⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\7D16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D16.tmp"
        151⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\7DE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"
        152⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\7EAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"
        153⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\7F87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F87.tmp"
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\8081.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8081.tmp"
        155⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\819A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\819A.tmp"
        156⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\82B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82B3.tmp"
        157⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\839D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\839D.tmp"
        158⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\8459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8459.tmp"
        159⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\8543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8543.tmp"
        160⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\862E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\862E.tmp"
        161⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\8737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8737.tmp"
        162⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\8802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8802.tmp"
        163⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\891C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\891C.tmp"
        164⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\8A06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A06.tmp"
        165⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\8AF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"
        166⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\8BCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"
        167⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\8CB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"
        168⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\8D81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D81.tmp"
        169⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\8E2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"
        170⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\8EF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"
        171⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\8F94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F94.tmp"
        172⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\904F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\904F.tmp"
        173⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\910B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\910B.tmp"
        174⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\91A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A7.tmp"
        175⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\9243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9243.tmp"
        176⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\92EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92EF.tmp"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\93CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93CA.tmp"
        178⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\9486.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9486.tmp"
        179⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\9551.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9551.tmp"
        180⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\961C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\961C.tmp"
        181⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\96C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96C8.tmp"
        182⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\9774.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9774.tmp"
        183⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\982F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\982F.tmp"
        184⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\98EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98EB.tmp"
        185⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\99B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99B6.tmp"
        186⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\9A62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A62.tmp"
        187⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\9B1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"
        188⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\9BE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"
        189⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\9CA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"
        190⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\9D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D40.tmp"
        191⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\9DEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"
        192⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\9E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E88.tmp"
        193⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\9F44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F44.tmp"
        194⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\9FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"
        195⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\A09B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A09B.tmp"
        196⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\A157.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A157.tmp"
        197⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\A1F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"
        198⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\A2BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"
        199⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\A389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A389.tmp"
        200⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\A454.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A454.tmp"
        201⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\A500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A500.tmp"
        202⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\A59D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A59D.tmp"
        203⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\A658.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A658.tmp"
        204⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\A704.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A704.tmp"
        205⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\A7BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7BF.tmp"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\A86B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A86B.tmp"
        207⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\A927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A927.tmp"
        208⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\A9C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"
        209⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\AA6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"
        210⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\AB0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"
        211⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\AC05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC05.tmp"
        212⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\ACE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"
        213⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\ADAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"
        214⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\AE47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE47.tmp"
        215⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\AED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AED4.tmp"
        216⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\AF61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF61.tmp"
        217⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\B01C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B01C.tmp"
        218⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\B106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B106.tmp"
        219⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\B193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B193.tmp"
        220⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\B27D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B27D.tmp"
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\B339.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B339.tmp"
        222⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\B3F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"
        223⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\B491.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B491.tmp"
        224⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\B55C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B55C.tmp"
        225⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\B5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"
        226⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\B685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B685.tmp"
        227⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\B7AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"
        229⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\B83A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B83A.tmp"
        230⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\B8E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"
        231⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\B982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B982.tmp"
        232⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\BA0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"
        233⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\BA9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"
        234⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\BB38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB38.tmp"
        235⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\BBE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\BC80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC80.tmp"
        237⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\BD1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"
        238⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\BDE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"
        239⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\BE93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE93.tmp"
        240⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\BF2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"
        241⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\BFCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"
        242⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\C058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C058.tmp"
        243⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\C0F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"
        244⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\C191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C191.tmp"
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\C23D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C23D.tmp"
        246⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\C2D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"
        247⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\C3B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"
        248⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\C450.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C450.tmp"
        249⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\C4EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\C588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C588.tmp"
        251⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\C625.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C625.tmp"
        252⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\C6C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"
        253⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\C78C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C78C.tmp"
        254⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\C848.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C848.tmp"
        255⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\C8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"
        256⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\C970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C970.tmp"
        257⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\C9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"
        258⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\CAA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"
        259⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\CB45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB45.tmp"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\CBF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"
        261⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\CC8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"
        262⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\CD39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD39.tmp"
        263⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\CDB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"
        264⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\CE72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE72.tmp"
        265⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\CF1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"
        266⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\CFAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"
        267⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\D046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D046.tmp"
        268⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\D0F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"
        269⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\D16F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D16F.tmp"
        270⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\D22B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D22B.tmp"
        271⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\D2C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"
        272⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\D354.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D354.tmp"
        273⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\D3E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"
        274⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\D48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D48C.tmp"
        275⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\D528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D528.tmp"
        276⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\D5B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"
        277⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\D651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D651.tmp"
        278⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\D6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"
        279⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\D75B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D75B.tmp"
        280⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\D816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D816.tmp"
        281⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\D8D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"
        282⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\D96E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D96E.tmp"
        283⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\DA0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\DA97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA97.tmp"
        285⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\DB33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB33.tmp"
        286⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\DBD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"
        287⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\DC4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"
        288⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\DCCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"
        289⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\DD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD56.tmp"
        290⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\DE12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE12.tmp"
        291⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\DEBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"
        292⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\DF5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"
        293⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\E015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E015.tmp"
        294⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\E0A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"
        295⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\E12F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E12F.tmp"
        296⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\E1BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"
        297⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\E257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E257.tmp"
        298⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\E2E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"
        299⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\E390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E390.tmp"
        300⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\E42C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E42C.tmp"
        301⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\E4B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"
        302⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\E526.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E526.tmp"
        303⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\E5B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"
        304⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\E630.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E630.tmp"
        305⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\E6DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"
        306⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\E768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E768.tmp"
        307⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\E7D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"
        308⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\E872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E872.tmp"
        309⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\E91E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E91E.tmp"
        310⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\E9AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"
        311⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\EA56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA56.tmp"
        312⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\EAC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"
        313⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\EB50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB50.tmp"
        314⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\EBDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"
        315⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\EC79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC79.tmp"
        316⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\ED06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED06.tmp"
        317⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\ED73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED73.tmp"
        318⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\EE1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"
        319⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\EEDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"
        320⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\EF58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF58.tmp"
        321⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\EFE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"
        322⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\F061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F061.tmp"
        323⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\F0DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"
        324⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\F17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F17A.tmp"
        325⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\F226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F226.tmp"
        326⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\F2B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2B3.tmp"
        327⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\F34F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F34F.tmp"
        328⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\F3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\F4A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"
        330⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\F524.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F524.tmp"
        331⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\F5B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"
        332⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\F63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63D.tmp"
        333⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\F6F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"
        334⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\F785.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F785.tmp"
        335⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\F812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F812.tmp"
        336⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\F8BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"
        337⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\F93B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F93B.tmp"
        338⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\F9D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"
        339⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\FA54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA54.tmp"
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\FB10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB10.tmp"
        341⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\FBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"
        342⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\FC48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC48.tmp"
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\FCD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"
        344⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\FD90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD90.tmp"
        345⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\FE2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"
        346⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\FEC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"
        347⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\FF46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF46.tmp"
        348⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\FFF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"
        349⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F.tmp"
        350⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB.tmp"
        351⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\188.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\188.tmp"
        352⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\214.tmp"
        353⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\2B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B1.tmp"
        354⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\34D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D.tmp"
        355⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\408.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\408.tmp"
        356⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4.tmp"
        357⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\560.tmp"
        358⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\60C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60C.tmp"
        359⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\6A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A8.tmp"
        360⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\745.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\745.tmp"
        361⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\7F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F0.tmp"
        362⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\89C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89C.tmp"
        363⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\939.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\939.tmp"
        364⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\9D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D5.tmp"
        365⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\A81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A81.tmp"
        366⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0D.tmp"
        367⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8A.tmp"
        368⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\BF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF8.tmp"
        369⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\C84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C84.tmp"
        370⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\D21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D21.tmp"
        371⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\D8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8E.tmp"
        372⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\E59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E59.tmp"
        373⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE6.tmp"
        374⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA1.tmp"
        375⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\101E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\101E.tmp"
        376⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\109B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\109B.tmp"
        377⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\1118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1118.tmp"
        378⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\11E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11E3.tmp"
        379⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\1280.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1280.tmp"
        380⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\130C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\130C.tmp"
        381⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\1399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1399.tmp"
        382⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\1435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1435.tmp"
        383⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\14D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D1.tmp"
        384⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\155E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\155E.tmp"
        385⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\15FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15FA.tmp"
        386⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\1696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1696.tmp"
        387⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\1723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1723.tmp"
        388⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\17BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17BF.tmp"
        389⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\188A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\188A.tmp"
        390⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\1927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1927.tmp"
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\19C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19C3.tmp"
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\1A40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A40.tmp"
        393⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\1ABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"
        394⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\1B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"
        395⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\1B88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B88.tmp"
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\1C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C34.tmp"
        397⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\1CE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"
        398⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\1D6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"
        399⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\1DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"
        400⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\1E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E95.tmp"
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\1F12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F12.tmp"
        402⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\1F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"
        403⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\201C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\201C.tmp"
        404⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\2099.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2099.tmp"
        405⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\2106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2106.tmp"
        406⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\21D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21D1.tmp"
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\226E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\226E.tmp"
        408⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\2339.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2339.tmp"
        409⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\23D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D5.tmp"
        410⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\2481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2481.tmp"
        411⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\24FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24FE.tmp"
        412⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\257B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\257B.tmp"
        413⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\2617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2617.tmp"
        414⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\26A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26A4.tmp"
        415⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\2750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2750.tmp"
        416⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\27DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27DC.tmp"
        417⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\284A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\284A.tmp"
        418⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\28D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D6.tmp"
        419⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\2982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2982.tmp"
        420⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\2A3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"
        421⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\2B09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B09.tmp"
        422⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\2BA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"
        423⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\2C32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C32.tmp"
        424⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\2CCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"
        425⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\2D7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"
        426⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\2E26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E26.tmp"
        427⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\2EA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"
        428⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\2F20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F20.tmp"
        429⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\2FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FAC.tmp"
        430⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\3049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3049.tmp"
        431⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\30F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30F4.tmp"
        432⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\3171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3171.tmp"
        433⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\31DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31DF.tmp"
        434⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\327B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\327B.tmp"
        435⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\32F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F8.tmp"
        436⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\3385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3385.tmp"
        437⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\3421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3421.tmp"
        438⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\34CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34CD.tmp"
        439⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\3559.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3559.tmp"
        440⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\35F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35F6.tmp"
        441⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\3663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3663.tmp"
        442⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\370F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\370F.tmp"
        443⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\379C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\379C.tmp"
        444⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\3809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3809.tmp"
        445⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\3896.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3896.tmp"
        446⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\3922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3922.tmp"
        447⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\39BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39BE.tmp"
        448⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\3A4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"
        449⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\3AE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"
        450⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\3B84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B84.tmp"
        451⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\3BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"
        452⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\3C7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"
        453⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\3D1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D1A.tmp"
        454⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\3DB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"
        455⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\3E72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E72.tmp"
        456⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\3F1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"
        457⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\3FBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"
        458⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\4066.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4066.tmp"
        459⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\40F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40F2.tmp"
        460⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\417F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417F.tmp"
        461⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\421B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\421B.tmp"
        462⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\4288.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4288.tmp"
        463⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\4315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4315.tmp"
        464⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\43C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43C1.tmp"
        465⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\445D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\445D.tmp"
        466⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\44CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44CB.tmp"
        467⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\4567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4567.tmp"
        468⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\45E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45E4.tmp"
        469⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\469F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\469F.tmp"
        470⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\474B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\474B.tmp"
        471⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\47C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47C8.tmp"
        472⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\4855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4855.tmp"
        473⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\48D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48D2.tmp"
        474⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\495E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\495E.tmp"
        475⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\49CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49CC.tmp"
        476⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\4A49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A49.tmp"
        477⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\4AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"
        478⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\4B81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B81.tmp"
        479⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\4C0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"
        480⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\4C9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C9B.tmp"
        481⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\4D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D37.tmp"
        482⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\4DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\4E50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E50.tmp"
        484⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\4EDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"
        485⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\4F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F79.tmp"
        486⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\4FF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"
        487⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\5073.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5073.tmp"
        488⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\50F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50F0.tmp"
        489⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\515D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\515D.tmp"
        490⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\51CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51CB.tmp"
        491⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\5248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5248.tmp"
        492⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\52E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52E4.tmp"
        493⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\5371.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5371.tmp"
        494⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\53DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53DE.tmp"
        495⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\545B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\545B.tmp"
        496⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        497⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\5584.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5584.tmp"
        498⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\563F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\563F.tmp"
        499⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\56EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56EB.tmp"
        500⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\5797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5797.tmp"
        501⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\5833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5833.tmp"
        502⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\58DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58DF.tmp"
        503⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\596C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\596C.tmp"
        504⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\59F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F8.tmp"
        505⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\5A75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A75.tmp"
        506⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\5AE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AE3.tmp"
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\5B7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B7F.tmp"
        508⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\5BEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"
        509⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\5C69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C69.tmp"
        510⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\5CE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"
        511⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\5DA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"
        512⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\5E5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"
        513⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\5EEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"
        514⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\5F57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F57.tmp"
        515⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\5FF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"
        516⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\6090.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6090.tmp"
        517⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\611D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\611D.tmp"
        518⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\61B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61B9.tmp"
        519⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\6245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6245.tmp"
        520⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\62E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62E2.tmp"
        521⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\636E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\636E.tmp"
        522⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\63DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63DC.tmp"
        523⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\6459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6459.tmp"
        524⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\64D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64D6.tmp"
        525⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\6553.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6553.tmp"
        526⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\65EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65EF.tmp"
        527⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\669B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\669B.tmp"
        528⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\6727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6727.tmp"
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\67D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67D3.tmp"
        530⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\6860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6860.tmp"
        531⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\690C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\690C.tmp"
        532⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\6979.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6979.tmp"
        533⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\69F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69F6.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\6A83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A83.tmp"
        535⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\6B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B00.tmp"
        536⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\6B9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"
        537⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\6C38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C38.tmp"
        538⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\6CA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"
        539⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\6D52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D52.tmp"
        540⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\6DCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DCF.tmp"
        541⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\6E9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E9A.tmp"
        542⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\6F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F74.tmp"
        543⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\7011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7011.tmp"
        544⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\709D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\709D.tmp"
        545⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\710B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\710B.tmp"
        546⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\71D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71D6.tmp"
        547⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\7272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7272.tmp"
        548⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\730E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\730E.tmp"
        549⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\73BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73BA.tmp"
        550⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\7447.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7447.tmp"
        551⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\74C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74C4.tmp"
        552⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\7541.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7541.tmp"
        553⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\75DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75DD.tmp"
        554⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\764A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\764A.tmp"
        555⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\76C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76C7.tmp"
        556⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\7773.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7773.tmp"
        557⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\7800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7800.tmp"
        558⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\788D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\788D.tmp"
        559⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\7919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7919.tmp"
        560⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\79C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79C5.tmp"
        561⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\7A61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A61.tmp"
        562⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\7ADE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7ADE.tmp"
        563⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\7B7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"
        564⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\7C07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C07.tmp"
        565⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\7CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CB3.tmp"
        566⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\7D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D40.tmp"
        567⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\7DCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"
        568⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\7E59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E59.tmp"
        569⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\7EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"
        570⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\7F82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F82.tmp"
        571⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\803D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\803D.tmp"
        572⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\80E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80E9.tmp"
        573⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\81A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81A5.tmp"
        574⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\8241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8241.tmp"
        575⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\82DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82DD.tmp"
        576⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\8379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8379.tmp"
        577⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\8406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8406.tmp"
        578⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\8493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8493.tmp"
        579⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\851F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\851F.tmp"
        580⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\859C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\859C.tmp"
        581⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\8629.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8629.tmp"
        582⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\8696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8696.tmp"
        583⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\8713.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8713.tmp"
        584⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\87B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87B0.tmp"
        585⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\883C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\883C.tmp"
        586⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\88C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88C9.tmp"
        587⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\8955.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8955.tmp"
        588⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\8A01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A01.tmp"
        589⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\8A9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"
        590⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\8B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"
        591⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\8BC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"
        592⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\8C24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C24.tmp"
        593⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\8CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"
        594⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\8D4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"
        595⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\8DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"
        596⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\8E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E57.tmp"
        597⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\8F12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F12.tmp"
        598⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\8FAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FAE.tmp"
        599⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\906A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\906A.tmp"
        600⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\9125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9125.tmp"
        601⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\91B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91B2.tmp"
        602⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\9646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9646.tmp"
        603⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\96B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96B3.tmp"
        604⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\975F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\975F.tmp"
        605⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\97EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97EC.tmp"
        606⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\9888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9888.tmp"
        607⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\9905.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9905.tmp"
        608⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\9972.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9972.tmp"
        609⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\9A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A0F.tmp"
        610⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\9A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A9B.tmp"
        611⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\9B28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B28.tmp"
        612⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\9BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BC4.tmp"
        613⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\9C60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C60.tmp"
        614⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\9CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"
        615⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\9D89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D89.tmp"
        616⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\9E06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E06.tmp"
        617⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\9E83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E83.tmp"
        618⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\9F20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F20.tmp"
        619⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\9FBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FBC.tmp"
        620⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\A039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A039.tmp"
        621⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\A0C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0C5.tmp"
        622⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\A171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A171.tmp"
        623⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\A20E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A20E.tmp"
        624⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\A27B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A27B.tmp"
        625⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\A2E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2E8.tmp"
        626⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\A365.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A365.tmp"
        627⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\A3E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"
        628⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\A45F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A45F.tmp"
        629⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\A51B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A51B.tmp"
        630⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\A5A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"
        631⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\A624.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A624.tmp"
        632⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\A6D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"
        633⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\A74D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A74D.tmp"
        634⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\A7DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7DA.tmp"
        635⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\A857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A857.tmp"
        636⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\A8C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8C4.tmp"
        637⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\A951.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A951.tmp"
        638⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\A9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9FD.tmp"
        639⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\AA99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA99.tmp"
        640⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\AB06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB06.tmp"
        641⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\AB83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB83.tmp"
        642⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\AC20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC20.tmp"
        643⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\AC8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC8D.tmp"
        644⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\AD29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD29.tmp"
        645⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\ADA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"
        646⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\AE52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE52.tmp"
        647⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\AECF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AECF.tmp"
        648⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\AF4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF4C.tmp"
        649⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\AFC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"
        650⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\B065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B065.tmp"
        651⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\B0E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0E2.tmp"
        652⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\B150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B150.tmp"
        653⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\B1DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1DC.tmp"
        654⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\B259.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B259.tmp"
        655⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\B2E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2E6.tmp"
        656⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\B353.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B353.tmp"
        657⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\B3D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3D0.tmp"
        658⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\B45D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B45D.tmp"
        659⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\B4DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4DA.tmp"
        660⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\B557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B557.tmp"
        661⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\B5D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5D4.tmp"
        662⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\B651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B651.tmp"
        663⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\B6DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6DE.tmp"
        664⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\B77A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B77A.tmp"
        665⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\B7F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7F7.tmp"
        666⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\B874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B874.tmp"
        667⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\B8E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8E1.tmp"
        668⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\B96E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B96E.tmp"
        669⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\BA0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0A.tmp"
        670⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\BA78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA78.tmp"
        671⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\BB14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB14.tmp"
        672⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\BBA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBA0.tmp"
        673⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\BBFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBFE.tmp"
        674⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\BCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAA.tmp"
        675⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\BD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD56.tmp"
        676⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\BDE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"
        677⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\BE6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"
        678⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\BEFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEFC.tmp"
        679⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\BFA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFA8.tmp"
        680⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\C025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C025.tmp"
        681⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\C092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C092.tmp"
        682⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\C10F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C10F.tmp"
        683⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\C19C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C19C.tmp"
        684⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\C209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C209.tmp"
        685⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\C276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C276.tmp"
        686⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\C332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C332.tmp"
        687⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\C3DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3DE.tmp"
        688⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\C46A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46A.tmp"
        689⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\C507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C507.tmp"
        690⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\C593.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C593.tmp"
        691⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\C620.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C620.tmp"
        692⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\C6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6AD.tmp"
        693⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\C72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C72A.tmp"
        694⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\C7B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7B6.tmp"
        695⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\C833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C833.tmp"
        696⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\C8B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8B0.tmp"
        697⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\C91E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C91E.tmp"
        698⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\C99B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C99B.tmp"
        699⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\CA37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA37.tmp"
        700⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\CAC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAC3.tmp"
        701⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\CB40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB40.tmp"
        702⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\CBCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBCD.tmp"
        703⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\CC3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC3A.tmp"
        704⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\CCC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCC7.tmp"
        705⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\CD54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD54.tmp"
        706⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\CDC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDC1.tmp"
        707⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\CE3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE3E.tmp"
        708⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\CEDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDA.tmp"
        709⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\CF67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF67.tmp"
        710⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\CFE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFE4.tmp"
        711⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\D071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D071.tmp"
        712⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\D0EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0EE.tmp"
        713⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\D17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17A.tmp"
        714⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\D1F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1F7.tmp"
        715⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\D284.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D284.tmp"
        716⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\D2F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F1.tmp"
        717⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\D39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D39D.tmp"
        718⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\D41A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D41A.tmp"
        719⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\D497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D497.tmp"
        720⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\D543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D543.tmp"
        721⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\D5B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B0.tmp"
        722⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\D66C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D66C.tmp"
        723⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\D727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D727.tmp"
        724⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\D7C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7C4.tmp"
        725⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\D850.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D850.tmp"
        726⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\D8BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8BE.tmp"
        727⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\D93B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D93B.tmp"
        728⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\D9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9B8.tmp"
        729⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\DA35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA35.tmp"
        730⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\DAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAA2.tmp"
        731⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\DB1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB1F.tmp"
        732⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\DBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBAC.tmp"
        733⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\DC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC29.tmp"
        734⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\DCA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCA6.tmp"
        735⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\DD23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD23.tmp"
        736⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\DDA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDA0.tmp"
        737⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\DE0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE0D.tmp"
        738⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\DEA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEA9.tmp"
        739⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\DF55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF55.tmp"
        740⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\E011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E011.tmp"
        741⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\E08E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E08E.tmp"
        742⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\E11A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E11A.tmp"
        743⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\E197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E197.tmp"
        744⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\E214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E214.tmp"
        745⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\E291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E291.tmp"
        746⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\E30E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E30E.tmp"
        747⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\E3BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"
        748⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\E437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E437.tmp"
        749⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\E4E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"
        750⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\E560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E560.tmp"
        751⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\E60C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E60C.tmp"
        752⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\E689.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E689.tmp"
        753⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\E706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E706.tmp"
        754⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\E792.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E792.tmp"
        755⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\E81F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E81F.tmp"
        756⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\E8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8CB.tmp"
        757⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\E977.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E977.tmp"
        758⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\EA23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA23.tmp"
        759⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\EAA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAA0.tmp"
        760⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\EB2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB2C.tmp"
        761⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\EBD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBD8.tmp"
        762⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\EC55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC55.tmp"
        763⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\ECC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECC3.tmp"
        764⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\ED40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED40.tmp"
        765⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\EDCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"
        766⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\EE59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE59.tmp"
        767⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\EEE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEE5.tmp"
        768⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\EF82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF82.tmp"
        769⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\EFEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFEF.tmp"
        770⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\F06C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F06C.tmp"
        771⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\F0D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0D9.tmp"
        772⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\F185.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F185.tmp"
        773⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\F202.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F202.tmp"
        774⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\F28F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F28F.tmp"
        775⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\F30C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F30C.tmp"
        776⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\F3A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3A8.tmp"
        777⤵
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\F444.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F444.tmp"
        778⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\F4B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4B2.tmp"
        779⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\F53E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F53E.tmp"
        780⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\F5BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5BB.tmp"
        781⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\F638.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F638.tmp"
        782⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\F6C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6C5.tmp"
        783⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\F761.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F761.tmp"
        784⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\F7EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7EE.tmp"
        785⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\F89A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F89A.tmp"
        786⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\F907.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F907.tmp"
        787⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\F994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F994.tmp"
        788⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\FA11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA11.tmp"
        789⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\FA9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA9D.tmp"
        790⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\FB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB49.tmp"
        791⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\FBC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBC6.tmp"
        792⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\FC43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC43.tmp"
        793⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\FCC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCC0.tmp"
        794⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\FD3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD3D.tmp"
        795⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\FDDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDDA.tmp"
        796⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\FE76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE76.tmp"
        797⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\FED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FED4.tmp"
        798⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\FF60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF60.tmp"
        799⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\FFFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFFC.tmp"
        800⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A.tmp"
        801⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\116.tmp"
        802⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\193.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\193.tmp"
        803⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\210.tmp"
        804⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\2AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AC.tmp"
        805⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348.tmp"
        806⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\3B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B6.tmp"
        807⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\452.tmp"
        808⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\4CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CF.tmp"
        809⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\56B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56B.tmp"
        810⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\607.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\607.tmp"
        811⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\684.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\684.tmp"
        812⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\730.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\730.tmp"
        813⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\7AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AD.tmp"
        814⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\83A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83A.tmp"
        815⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\8A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A7.tmp"
        816⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\924.tmp"
        817⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\9A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A1.tmp"
        818⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\A4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4D.tmp"
        819⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\AAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAB.tmp"
        820⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\B37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B37.tmp"
        821⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4.tmp"
        822⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C51.tmp"
        823⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\CCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCE.tmp"
        824⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\D4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4B.tmp"
        825⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\DC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC8.tmp"
        826⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64.tmp"
        827⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF1.tmp"
        828⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\F7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7D.tmp"
        829⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\FFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFA.tmp"
        830⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\10A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10A6.tmp"
        831⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\1123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1123.tmp"
        832⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\11EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11EE.tmp"
        833⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\128A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\128A.tmp"
        834⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\1327.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1327.tmp"
        835⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\13B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13B3.tmp"
        836⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\1430.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1430.tmp"
        837⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\14AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14AD.tmp"
        838⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\152A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\152A.tmp"
        839⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\15B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15B7.tmp"
        840⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\1644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1644.tmp"
        841⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\16D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16D0.tmp"
        842⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\175D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\175D.tmp"
        843⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\1818.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1818.tmp"
        844⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\18C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C4.tmp"
        845⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\1970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1970.tmp"
        846⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\19DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19DD.tmp"
        847⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\1A5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A5A.tmp"
        848⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\1B06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B06.tmp"
        849⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\1B93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B93.tmp"
        850⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\1C4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C4E.tmp"
        851⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\1CCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CCB.tmp"
        852⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\1D39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D39.tmp"
        853⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\1DD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DD5.tmp"
        854⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\1E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E33.tmp"
        855⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\1EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EA0.tmp"
        856⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\1F2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F2D.tmp"
        857⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\1FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FAA.tmp"
        858⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\2027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2027.tmp"
        859⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\2094.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2094.tmp"
        860⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\2140.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2140.tmp"
        861⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\21EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21EC.tmp"
        862⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\2279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2279.tmp"
        863⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\22E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22E6.tmp"
        864⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\2353.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2353.tmp"
        865⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\23D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D0.tmp"
        866⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\243E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\243E.tmp"
        867⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\24BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24BB.tmp"
        868⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\2547.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2547.tmp"
        869⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\25A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25A5.tmp"
        870⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\2632.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2632.tmp"
        871⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\26AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26AF.tmp"
        872⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\272C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\272C.tmp"
        873⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\27B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27B8.tmp"
        874⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\2855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2855.tmp"
        875⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\28D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D2.tmp"
        876⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\295E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\295E.tmp"
        877⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\29FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29FA.tmp"
        878⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\2A87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A87.tmp"
        879⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\2B04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B04.tmp"
        880⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\2BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA0.tmp"
        881⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\2C1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C1D.tmp"
        882⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\2C8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C8B.tmp"
        883⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\2D17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D17.tmp"
        884⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\2DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DA4.tmp"
        885⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\2E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E21.tmp"
        886⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\2EAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"
        887⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\2F4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"
        888⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\2FD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FD6.tmp"
        889⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\3053.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3053.tmp"
        890⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\30E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30E0.tmp"
        891⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\315D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\315D.tmp"
        892⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\31DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31DA.tmp"
        893⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\3276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3276.tmp"
        894⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\3322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3322.tmp"
        895⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\3390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3390.tmp"
        896⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\341C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\341C.tmp"
        897⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\34B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34B8.tmp"
        898⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\3574.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3574.tmp"
        899⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\3601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3601.tmp"
        900⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\367E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\367E.tmp"
        901⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\36EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36EB.tmp"
        902⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\3768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3768.tmp"
        903⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\37D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37D5.tmp"
        904⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\3852.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3852.tmp"
        905⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\38CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38CF.tmp"
        906⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\394C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\394C.tmp"
        907⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\39D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39D9.tmp"
        908⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\3A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A66.tmp"
        909⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\3AD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AD3.tmp"
        910⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\3B6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B6F.tmp"
        911⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\3BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BFC.tmp"
        912⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\3C88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C88.tmp"
        913⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\3D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D44.tmp"
        914⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\3DD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DD1.tmp"
        915⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\3E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E4E.tmp"
        916⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\3ECB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3ECB.tmp"
        917⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\3F57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F57.tmp"
        918⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\3FD4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FD4.tmp"
        919⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\4070.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4070.tmp"
        920⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\40ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40ED.tmp"
        921⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\4199.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4199.tmp"
        922⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\4245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4245.tmp"
        923⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\42C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42C2.tmp"
        924⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\4330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4330.tmp"
        925⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\43BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43BC.tmp"
        926⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\4449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4449.tmp"
        927⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\44B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44B6.tmp"
        928⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\4533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4533.tmp"
        929⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\45C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C0.tmp"
        930⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\464C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\464C.tmp"
        931⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\46C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46C9.tmp"
        932⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\4737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4737.tmp"
        933⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\47A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47A4.tmp"
        934⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\4821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4821.tmp"
        935⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\489E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\489E.tmp"
        936⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\493A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\493A.tmp"
        937⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\49C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49C7.tmp"
        938⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\4A54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A54.tmp"
        939⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\4B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B00.tmp"
        940⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\4B8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B8C.tmp"
        941⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\4C09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C09.tmp"
        942⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\4C77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C77.tmp"
        943⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\4CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CF4.tmp"
        944⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\4D9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D9F.tmp"
        945⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\4E3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E3C.tmp"
        946⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\4EE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EE8.tmp"
        947⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\4F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F74.tmp"
        948⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\5010.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5010.tmp"
        949⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\50AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50AD.tmp"
        950⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\5139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5139.tmp"
        951⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\51A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51A7.tmp"
        952⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\5224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5224.tmp"
        953⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\52B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52B0.tmp"
        954⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\532D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\532D.tmp"
        955⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\53AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AA.tmp"
        956⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\5456.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5456.tmp"
        957⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\54E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54E3.tmp"
        958⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\557F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\557F.tmp"
        959⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\563B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\563B.tmp"
        960⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\56B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56B8.tmp"
        961⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\5773.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5773.tmp"
        962⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\57E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57E0.tmp"
        963⤵
        
        PID:7540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\10EE.tmp
Size 520KB
SHA256 9f97d3dfe8501dd556c03f0984e34f4063dd3de017d581ccbca9c594af871f35
MD5 2c31c5423017a08598a4048282bf2576
SHA1 68d457bb97ceb87b0fdf29371bd5e6b8fea40b10
SHA512 498a1c3993146acfb42409c63b65b0b9b976cc49451e96c2d874c93a8791a337270e3d86df77172adce48062e2596dacff598f509982506518c4f5b26f948caa
SSDEEP 12288:gj8fuxR21t5i8fnosLmyeHhCVp1zF0alJpNZ6:gj8fuK1GYnosrrVfZ0aJpNI
TLSH
T111B4E0127944C033E8E715304A26CB625BBE7C759B3A95C73B84366E6FB42C1E63930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

119A.tmp

Path C:\Users\Admin\AppData\Local\Temp\119A.tmp
Size 520KB
SHA256 18248cde501cfd9c4e638fe79f328ab5ff25852ec95695c04847889c22c785ba
MD5 1d38b4ba2c9bd7c58f42facb034df349
SHA1 24ebc786061ffa91e7ffbf310c01ff8dadb3f385
SHA512 745a4390603e72f8d70832593a2dc64c0e6e460d8b68d8b4e759480264707e99184c091ecac4af57ade68455e17b544094c46bee5caa27a2b910c4514fd6b4d7
SSDEEP 12288:gj8fuxR21t5i8foi8Sf7lZ7u0flmHGLDt0NZ6:gj8fuK1GYoixlx7foHED6NI
TLSH
T1ADB4F0127948C033E89215315A66DB664BBE7D798B3695C73BC0366E7FB82C1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1294.tmp

Path C:\Users\Admin\AppData\Local\Temp\1294.tmp
Size 520KB
SHA256 94d81275a95a782a98d618c40d6f5ac0416237d7b7d5ee9b073391715f14038a
MD5 084d8d53576b376effd8947da2fb7d6d
SHA1 0cefc316e676d7259774e934d1d3f5295ea34801
SHA512 ee5407e0cf06cd7e78e01be45baa650284a5b90257b682c69c6b379aad0447100727bd2e07d21aad6e074c6aa1da8d5606f3aecb18d3689de4182fd86db31b01
SSDEEP 12288:gj8fuxR21t5i8f11/AIE0Kq5leT5wV94YgTNZ6:gj8fuK1GYvVE0pV94ZNI
TLSH
T1A1B4F111B545C033E4E615314B62DBA50BBABD799B3695C73B8036BE2FB52C1E63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

136F.tmp

Path C:\Users\Admin\AppData\Local\Temp\136F.tmp
Size 520KB
SHA256 e2db9334992368309686166c0a436c138af9f857ffc3e90bfcdfc987827b1a19
MD5 097084c1f413ae5a866e8dacfaa8cd3a
SHA1 e5a88dd9ce43eddb2d5993dda4bca10b123d03b6
SHA512 9c3263564db68a51775bbc8a67573d82b455193d0ccb1bc18ca2898e9129822707a0292952e710f73b0ecd632e07a5ddce4f4b308e74070305664078d6504107
SSDEEP 12288:gj8fuxR21t5i8fPfuWk5BHPyV8KuKWMA7knD3NZ6:gj8fuK1GYPfuWkHvXMA63NI
TLSH
T19DB4F012B545C032E9D616304AA2DBA10BBE7D399B3695C33BC4366D7FB52D1E63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\14B7.tmp
Size 520KB
SHA256 868dbb6093b3a78231ab7489c0f995464464f003fbb74596eb2ab17e179f4349
MD5 fad43b11697f753dd13a0d00861a69c7
SHA1 ee15263af2d8de510183cc1027b38719830b54e4
SHA512 898adeae9698de41a1c644325bc416dc08512a5449999ca4f366755f89d3ce94052d816ec1d024287e6721c9dbb73ede178c7edb5b2dba5f0d26217570ef2566
SSDEEP 12288:gj8fuxR21t5i8fYCCrzaPehDeKS6VeNZ6:gj8fuK1GYYC8zDy6VeNI
TLSH
T1FAB4F1127948C033E8D215354A92DBA20BBF7D794B2695C73BC436AD6EB52C2E73530B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\15E0.tmp
Size 520KB
SHA256 65d489ccb28e1c3ef2fd35558735993b354c82be15f4c4eab1dccc727559e8b6
MD5 c75b136865666ce8c28bf6fd3b9b3a9f
SHA1 90254b62e0cb540207fea9e5314e2d16b7d16df7
SHA512 2f0912427ed2e4d151e0a82263a3268899de38221c0bafdd34aec3a72c73dd4a7f8b3fbf72f3493a19286cbe6f3e5c40355f1c0241cafa789eb6557599a6dd78
SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbQOX7iMtDANglUl2uxFXkMbh30sb3NpeaP:gj8fuxR21t5i8fZ6DR6pRP7Npp61NZ6
TLSH
T1CDB4F111B949C032E9D716314A22DBA60BBB7D74872A95CB378436AD7FF52C1973830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\16CA.tmp
Size 520KB
SHA256 a7ec216cd0687a62414abe694477b99d9463ea0fbf46993938df8d49374b8a7a
MD5 8ad38bcca3d23a48610a1dcefdcb34cd
SHA1 321eca968273a75b32212e924651024e632cdbe8
SHA512 9e624474b3217075c485a30bbc793298712fdc3424703034c130f5aec3df6e6b328f7ee0d8218aea047cc6ec34c02150c3781237ac90423a462f38db7103e8c5
SSDEEP 12288:gj8fuxR21t5i8fYlUbCnOiq/tLwe5fv2LNWpNZ6:gj8fuK1GYYSbPiqFNwLwpNI
TLSH
T11BB4F122B588C032E5D205324A56DBA10BBEBD358B3695CB3BD039BD6FB56D1D638307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1786.tmp

Path C:\Users\Admin\AppData\Local\Temp\1786.tmp
Size 520KB
SHA256 22b93f9039449d37b4347b725290389f8c8215ce36c071715db19aa48627c4a1
MD5 2ee76679fa3b4c12a8eca91e3bc4fa3e
SHA1 18eec1a2824205890d3c184a75ba28fe558ea834
SHA512 0da6491a5a5ed6ac29500e55d10b05f4596bced92d6d1999abc03119156497cf877bfc79fef217766ead157ef1fb7962096670d014c526d4145795e89eac0595
SSDEEP 12288:gj8fuxR21t5i8f2n2CiHy/Vmli/h27wmB/NZ6:gj8fuK1GYYF/gr7B/NI
TLSH
T12EB4F1217945C033E9E205314B62DFA25BBE7C749B2695C73B80366DAEB52D1CB7830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1880.tmp

Path C:\Users\Admin\AppData\Local\Temp\1880.tmp
Size 520KB
SHA256 a1bf65dc2ebe87cb0480418b985a3f222f1d50b437841aa8c62986a860eef870
MD5 4684e41ac60dca8a870247868e8ae7cf
SHA1 b3b340d503ac36b88e180409595723a815a1c5bf
SHA512 6f70b934aca6b7a7acc290e3409b1e07a5e9dcacc3bd79551d914a90b5819cd631869a47c6a439b0d530a58905ea18a685ae0cd52b97997d330f3455448795b9
SSDEEP 12288:gj8fuxR21t5i8fjEmtzzk5WTDW19YfLNZ6:gj8fuK1GYLlk5TQLNI
TLSH
T1DBB4F102B985C032E4D311314A66DBA60BBEBD395B3A95D73B80366D6EB53C1D77830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192B.tmp

Path C:\Users\Admin\AppData\Local\Temp\192B.tmp
Size 520KB
SHA256 b046033db06cc9774f1212b3d26148824e01056c2a6034b7f678ac3b7c008564
MD5 92cf6f3ce8a89f338cdab9d2df097b2c
SHA1 7a2267492468cbd842aa8f13779654ba64532c6d
SHA512 84ca69859b977d3a1364458f00e3f642676ce6b5a4f17eeb38ebb5cb7f54030acb1f8c827f134535d6e666cad48157f298c0ff710df9a755741b2d926ff427ef
SSDEEP 12288:gj8fuxR21t5i8fp7AGYbEcdfIhdDmlVLxsQFIv1kNZ6:gj8fuK1GY6GfcJVLxJFs1kNI
TLSH
T1CAB4F112B945C032E8D315314B25DBA60BBE7C799B3695C73B8426AE6EF42D1D33831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\19F7.tmp
Size 520KB
SHA256 afbef052b4fe77dd6bdfe74815340ed088521f40573d8d221dd6e092829d2599
MD5 bd127dbfe660b489b1220762865e8e50
SHA1 45d031ca187112bd7fade221a433813545b558a0
SHA512 2f640ea2d63b7d5cd71f36c9a14a6fc132b46ca44324197d06a33f4e47a4f71b4951e55be0e53efcaa8039574653d4a861e2f565d853c5d6c807545e097a7e7f
SSDEEP 12288:gj8fuxR21t5i8fzc4d25I99CG5/CcKr/0NZ6:gj8fuK1GYo4d25yo8CcEsNI
TLSH
T168B4F1117944C032E9D616304B66DBA25BBE7D785B6691C73B803A7E6FB12C2E73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AE1.tmp
Size 520KB
SHA256 f31a913edd5fed84133912c25982944f0ad34d47e21598ec6a7a2609bc07bfce
MD5 100d56b614bb0577b047bbbc15918bd3
SHA1 fb91e01ad743980cbf529e6da5bd298b707c3e36
SHA512 dd10375ec22a31519776543a26b375d7a1345499afb056a70bae48b384275663ba636c6c4fea7625bd06b8bd6f2d41a029757226dea7e13067454e245f4bbef6
SSDEEP 12288:gj8fuxR21t5i8fS2NMDxTORvUk7MAqPARos/mTAo2NZ6:gj8fuK1GYRNM4RMoQAxNI
TLSH
T14BB4F112BA48C032E9D615314B16CBB50BBEBD74972695C73B8036BE6FF52D1D63830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\1BBC.tmp
Size 520KB
SHA256 eb3b40e1550b745c74edb050cfe3dea763119f3ae017419a639688d5009227a0
MD5 3b5cebe7ce7695fbf1e513c7f676d927
SHA1 e0eb993d21cb7a1cc223f55142dfcb1118fbd2ce
SHA512 c8406b33489a47b163fae8f7661134a834173e74fc990ea66672275d52ebe8bf229f7973da70749d201f965a245f496a25ad22bd2fc30d39b400e4f62b995fb6
SSDEEP 12288:gj8fuxR21t5i8fg4cc0GyLdwndtmLPhXWICRNZ6:gj8fuK1GY2cVyh9LpGI6NI
TLSH
T1B7B4F1027848C036E9D611304A66CBA51BBEBD758B26D5C77BC436BE6FB52C1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1C48.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C48.tmp
Size 520KB
SHA256 ba65b5f1bf958201e2092be50ba4c69994f19825bdddf30da3a9b778d6e7d25f
MD5 bc50ff627af423bbb305b0dfdca35578
SHA1 c2c25ef163bec12efeb89457387d276485478a90
SHA512 689b6e62dbdd4baae7d8f226c4273a7fb0ca10e6a7ebee9897c4afe2df18eaa40d9c2f2b6d81766b7f604887e9e798dccb20c0536c497173f75d256cc4c83c3a
SSDEEP 12288:gj8fuxR21t5i8f+J4GHjI2hwpcYsyP34ctGAfPeNZ6:gj8fuK1GY+J4gzhtYLvHtGAHeNI
TLSH
T177B4F0117888C032E9D615305B56DBA20ABEBD65977695C33B8036BDBFB52C1E73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D04.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D04.tmp
Size 520KB
SHA256 6e88553b479e718478c76f1a4960f48d0511d19fb8fc033ab59e21e06f7c0b71
MD5 e7cb771671ce2e45f459ad5f78933b75
SHA1 4777f42c153137cb307e0c70c97c4df7d9fa297a
SHA512 7f64c4dd2869b0d48f5847a1e6d8f11bda5702f83d1640fb6756048d3a2871dcce9a0d6d4e1c9008458ec6e12075f3e92de9ab8d160459a77950863f8db3769d
SSDEEP 12288:gj8fuxR21t5i8fKBdb4wBgOeA/t/8ISzCOaarNZ6:gj8fuK1GYKBdb4wBgHA/x8IXsNI
TLSH
T1A8B4F1117948C033E8A616310B62DBA11ABE7C759B3585C73BC53AAE7EB52C1D73870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1DB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\1DB0.tmp
Size 520KB
SHA256 a025c255876954043b9401f66e5362e377df51684c1d5e33fdbc0b0e3c2e103e
MD5 e3db6635b71f892edf78d48a66708c22
SHA1 a496a74957d7cf4aaa9fa74d20b0443484dec261
SHA512 5ae5bbaa1c639165bc8c04c36b75bf450ae135a3af30b78d3245c0d02e2fbeafb2a05929e5547e142c54573446f51803df4cc7e80ad10b8dc4073ff580faf419
SSDEEP 12288:gj8fuxR21t5i8fc4h+CE7Xln0sQvNUKevcT28hp5dNZ6:gj8fuK1GYNCJ0sQvNUTb0pTNI
TLSH
T132B4F1127548C032E9E715314B16DBA24ABEBD759B3691C33BC036AD6FB42D1E67830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1EAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EAA.tmp
Size 520KB
SHA256 81a9dd4bc9bc55d65c6ab93f90f2afdd54216d7978e0f47bd1c5a23c5794d9b0
MD5 3454068cfe0f50c8777fc32bab2c8d60
SHA1 3f9e3674585a98bc165d61e3539852e527d435f8
SHA512 fe08ef595869483947b818bbdd71dc49044a6bd6146a95919ee648dd83fa3f47de874cd4238c3c35c8d0d2d32d94f21db5b598f145aa3d5b06e36a376eae76e7
SSDEEP 12288:gj8fuxR21t5i8fnAwQCp6PrhbRim98FpcOcycNZ6:gj8fuK1GYAwQphbRmFpcOhcNI
TLSH
T1C7B4F1117144C037E99226314A26DBA14BBEBD799B36C4C737C436ADAEB52D2D73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F36.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F36.tmp
Size 520KB
SHA256 8b0ff94c8d767e38a0acdfe4e2c4477572a823735cf2ff498e4ab2b43b6a35f9
MD5 25c7972474782f7a0761363f06dff398
SHA1 c63bfddd2fb55a9a51f9a876d6139d762775f248
SHA512 625761bbad83651bfe42df0087a7bbc45fb5c559d4083e60868403e5b8f29e510bb2927e5c947a22ef5bc744a08d100bd10891fc2d9ab1ad6238400d54a61b19
SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbO4fzqV7JUeZ5ffEaVD+1U6V+KnusNfW97:gj8fuxR21t5i8f78zqL3nEha6OdorNZ6
TLSH
T17BB4F122B884C033E5D716314B62DBA106BE7D799B3685C73BD036AD6FB42D1D67830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2011.tmp

Path C:\Users\Admin\AppData\Local\Temp\2011.tmp
Size 520KB
SHA256 1a662fbd3741544e9ce5289977e16f4c8fc93e5ad99e232cb45c5e23733876bf
MD5 58a1d7f6aaadd27e87a2aa53699c6901
SHA1 6dabc26a4d586a115b24a13c55383feeec9fb7be
SHA512 9c2fbf4ab2cf4926663a640662061cccbbb8f2d943fd23e228ecd61f044e00831dfd8f20076279e4e76543a305f7d0b615b7b5e0e083123ea3a9b543e4b4e161
SSDEEP 12288:gj8fuxR21t5i8fSxNnmzrsx7l3YNmrBwoHjLYBCRhgNZ6:gj8fuK1GYUmzwweHjLphgNI
TLSH
T14EB4F112B985C036E9E311304B62DBA65ABEBC754B3591C73B8432BD6FB42D1D23930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\20BD.tmp
Size 520KB
SHA256 f01007360748bdaae8b31013920820135c6177010d55fb150fe2a8fa357ef1c1
MD5 3e576fd9b9ce886cbbcc7206b924c2b0
SHA1 5e15b1d10fd2b762ed50c3a23eb1154b1e6b33cc
SHA512 fdb4b8cd2a9b055557f09047d6c22f336da6758c98205c02b28971744cc3e200d5372e49c942e4999db3fd75adb691797fd3a1fed57fe5339b9fa00296768542
SSDEEP 12288:gj8fuxR21t5i8fMS2i9t15E3EEdof/DesBNZ6:gj8fuK1GYM89VE39of/DesBNI
TLSH
T163B4F112B945C033E8A215304B56DBA147BE7D798B6A95C73B903A7D6F742C2DB3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2188.tmp

Path C:\Users\Admin\AppData\Local\Temp\2188.tmp
Size 520KB
SHA256 ead9a64b27ec51ee54d07c02a7fe1bef4e8ceb10a04a0b7056eb23f48488749d
MD5 902d1508a53c918f49bbd2eeefe01570
SHA1 2351dd72874682ebd3ef267f3b864523f8729df9
SHA512 7d59e5fd1d21063c80135c46328450e0fd206d6c51cd2777833d4831532c7edb835f24e6fa08e9aca075abe0910347ef0b1b27c9c6b56c0d1d45f34b6e02ac5b
SSDEEP 12288:gj8fuxR21t5i8fYd/wyYlqZPpwhdX+P2cnOXUNZ6:gj8fuK1GYe/wBQanuaENI
TLSH
T122B4F1167549C032E9D215310B66DBA60BBABD354B3699C73B80367D6EB43D1EB3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2282.tmp

Path C:\Users\Admin\AppData\Local\Temp\2282.tmp
Size 520KB
SHA256 6d64efa8998649a92781619c40d4a520b04ca843a10b583f20257977f077abf0
MD5 d26cc9fb8fbc66e2e04896c3932443db
SHA1 475a323d58e8cfde6d141ea2be7ec4f1f9301aa5
SHA512 5c7dfd8bbbd1a1a05161a88508abfc12c6322fd746652b92e88f476fdeeddce2d636dae1878cb3f0f00e49d16cff04827f25e6a93f25f09aa7c44db695d07a09
SSDEEP 12288:gj8fuxR21t5i8fuRnNbZ157A829idly2D0wg3oNZ6:gj8fuK1GYOn5Tpe9Sj0wOoNI
TLSH
T152B4E011B489C433EAE305314F66DBA10BBE7D399B3A95C73B84266D6FB56C1923430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

235D.tmp

Path C:\Users\Admin\AppData\Local\Temp\235D.tmp
Size 520KB
SHA256 e79904c7169a01d6b51a65e17acd38b02d56c64f98dae87d90406cd4397ea02a
MD5 21ff3193983f7108a0f7483633910f85
SHA1 dd491741c89aae245b16a3eb2c4afa757e232f6e
SHA512 367f32bad0dd16c53b59a04f30fc61f5cf4b1c0a63157c415c2263f84258808e5ae9fe805ed7f29454bc82b933b02a13208757f578233551e289a7613d836f91
SSDEEP 12288:gj8fuxR21t5i8f2qkn+PqTlZYyA/iYhG4sNZ6:gj8fuK1GY2qk4qTlnYh5sNI
TLSH
T1B4B4F112B544C037E9D616358A22DB614BBE7C399B3A95C337C42ABE6FB52C1D638307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2438.tmp

Path C:\Users\Admin\AppData\Local\Temp\2438.tmp
Size 520KB
SHA256 b92304fb8b0888298a4eaf92a6d377a407f84d1125b96e36d7ea5443fb029091
MD5 3b96ad5e9fe37d4928bd9839681288fd
SHA1 be055f04aa9b4512d090bd3f9676cbb6a0507452
SHA512 70b3ebb194b7591a8f742efefc9671c9896903dff5997d40d403f6e522cb6780d0115adad34e6bb235e684f937cf82b082701c02b1b82185bbcd8efac184c6a4
SSDEEP 12288:gj8fuxR21t5i8f8K72Z8JmBCokEVcF25wAxPIPiuyKNZ6:gj8fuK1GYYZ8YvkEiFNEgPiuVNI
TLSH
T165B4F112B849C033E9D311314A56DB610BBE7D349B2A94C73B913AAD6FB52D1E67830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2551.tmp

Path C:\Users\Admin\AppData\Local\Temp\2551.tmp
Size 520KB
SHA256 235781c6f317867a0f2aec6968bfaa92f8734844d39f31405cb090e7a2160ca2
MD5 bb3d30d05c0d1355ffb39e59cb8842df
SHA1 086b010e242bca4dae34fab85ff89f06d9ac3914
SHA512 2a55c0d368e087cb5783c75d13e43159458cf4a690d46fc5d0aa8fb643abe2380d83ae25236bc18b594eb47d06bf5abf0d98e2cb266c79d8d4cea8d6d0a96abb
SSDEEP 12288:gj8fuxR21t5i8fSiLO8OeLqRYkGa9+DqRZxk1bNZ6:gj8fuK1GYfOf6qnJ9rS1bNI
TLSH
T110B4F112B985C032E9D612315B52DB610B7E7C758B3599C73BC036AE6FB52E1E63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

262C.tmp

Path C:\Users\Admin\AppData\Local\Temp\262C.tmp
Size 520KB
SHA256 95cd979b70b1c5853a4f5bfc64d09adbd6254d7ba39ae5b6b9159142e08f493e
MD5 0653c53613413943bd19592c181690db
SHA1 be38752ea46c92ea46ad73bf14e6ab049cea47b0
SHA512 b4314fecf7f2db5b277926ce93d512ff722cdebae0aebcca009475de76113d89c4d5ccbae336903f9a52839548b32598755113a6a03deea6c5406f1bd1d34023
SSDEEP 12288:gj8fuxR21t5i8fcWQ1CTQ1oZBCxAUyjx/3N9pNZ6:gj8fuK1GYbQQrZWfYx//pNI
TLSH
T140B4F1127945C032E9E201314BA6DFA10ABE7D759B6295C37BC0366D6FF52C2DA3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\26E7.tmp
Size 520KB
SHA256 0ed64d803cbf8b4e53f1781af9f1e1bb4be5417b8e3b311fb65b8c6976f0e7f8
MD5 e0a9dc00be0f1b89e3162397a0942fbe
SHA1 b8f806c330e15132c4877c75a5297941e92f0d42
SHA512 65da4b3d76ad798fadbfb416ad5f837a6b6dd5327d0803dee9d67cccbead9cf6e192ff80270561c3375d3d9bade7959b3fdd7f068bc6b88dd7d2629a91825692
SSDEEP 12288:gj8fuxR21t5i8fDy4IRl8GUEqvB8e4fI3mmHhNZ6:gj8fuK1GYD2hqvWe4LshNI
TLSH
T1BDB4F112B584C033E9E614314BA1DB611BBEBD395B26C5C33BC53A6D6EB52D1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\27A3.tmp
Size 520KB
SHA256 0ebccc017a5c990dc66da81df27e854eda446169e101974b60dd58ff478670de
MD5 c4e65a84a25531704863c42c7a746113
SHA1 a583d1c9191c2a240f5518205e76af8f4921f803
SHA512 5e981f59fb50b568e3506e85ab6017dd91b5f87e3eddddbc0996a94e148b983b2d9879057b868b139e9d4a856df9388480420b044854e30f39b061ef80ed0abc
SSDEEP 12288:gj8fuxR21t5i8fbAxgwvPBmUHLXhzD0qa3ZGtU9NZ6:gj8fuK1GYbAfvPjHLXhf0D3KU9NI
TLSH
T157B4F112B885C033F5D612314B26DB621BBEBC399B2694C73B80366DAFB52D1977530B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

288D.tmp

Path C:\Users\Admin\AppData\Local\Temp\288D.tmp
Size 520KB
SHA256 c44c24e031e3199fd1f58eae6134ab01e297052c4c240a58b39727d9b628b515
MD5 ec172a33cf3ddd71fd70b0a5160e03a8
SHA1 6549cbe3ed08baa1cad9083125f19d2338148a09
SHA512 fe2e6a69e62b460ddf226a4ae46b447298e8bfd28d024c3b2aa08ca6474fed26576f034e030825ff65e94e92f9fef6073cde84c536c2ce3c0709df8dffe94f95
SSDEEP 12288:gj8fuxR21t5i8ftUUchXzN8Z4ZpColY4NZ6:gj8fuK1GYqUcQKRNI
TLSH
T1D5B4F012B545C032E8E615314B62DBA15BBE7C755B2295C73BC03AADAFB52C1DB3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2968.tmp

Path C:\Users\Admin\AppData\Local\Temp\2968.tmp
Size 520KB
SHA256 93116a0a3adc09320c7b66d7b764fb50f5397c4cba3880fbd31c62e6648c68b9
MD5 2a950d5a2ba82c4ef931790e377ce35d
SHA1 361601db6070b59ad45d87d3f60424e88b8865de
SHA512 c2c69a38106945b0ea026509582b72b21730969614816a4c0e609daf71908e86e5b8d8c84afdc5d7dc96793852c64626fd0d7c302ba199926d6e479ba47a3d6c
SSDEEP 12288:gj8fuxR21t5i8f1KeOizYaysuFKG5nzzAPKT3NZ6:gj8fuK1GY1Kecal8nHqCNI
TLSH
T1E0B4F1017545C032E9E602314B56CBA25BBEBD794B72C1C73B8436ADAFB92D1D63831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\EFA.tmp
Size 520KB
SHA256 98b904e2efbf24e1765bddccb7b0e35f039f7e70aa51bd04a3fc03ee0286b435
MD5 982e647d9252c011b77ea667e2432b9e
SHA1 59014e3306bc9bfbbe334c44a866d4d1bfa4108a
SHA512 d7179c5d330f4941b1f3985b687bb0093301abd55220a3b83aae579eadf187af9ce0fa6a2c54278d7ef9bc95fedee238d05eb002404be45ff3fd04f0dc4e6726
SSDEEP 12288:gj8fuxR21t5i8f1jrAJnCcHmc4t/3+yreP8c7whNNZ6:gj8fuK1GY1jMJC9RreP8KwhNNI
TLSH
T143B4E0117944C032E9E215304A66CBB11BBE7D794B3696C73BC036AD6FB52D2A73930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB6.tmp
Size 520KB
SHA256 08d0369deb4d672b5e9528620b1f47346101eabc65a06b477d042ab58a2269a5
MD5 da3d917bb6d71883f80b7b9c2d41bd4d
SHA1 12f0f2cb0b134b1b9467701d02409064e938a2ca
SHA512 03a4a616d42158588f3e81ba943b144e3e9b179fedeac2d9501eb2c66ca208c57fee41dd18f0732dbaa36972b59ff01bb26321e88f2030dc4b937a1238ccdfba
SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkb58u9hFO3cxzyVPv+1+TZANoqtPahyn8Yj:gj8fuxR21t5i8fc8sxzcv+wTphABuNZ6
TLSH
T14EB4F1127945C037E8D216318B66DBA11BBA7C768B2691C33BC036AD6FB52D1D73831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads