0ca956afa7a93ddbd52154c52f78c6666ef3305ab78962f56ea77b48dcde1ae8

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_63a966826254dc6120c13b0374eb2f57_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260813-t8dvxathqf
SHA256 0ca956afa7a93ddbd52154c52f78c6666ef3305ab78962f56ea77b48dcde1ae8
MD5 63a966826254dc6120c13b0374eb2f57
SHA1 8c13c50f0fa964f747caddf51de5b359e19ac421
SHA512 221803dacc71c7f0d100cecc6b82c2d6dcb691e2004cd448acf77b046727ded20acc8d7c82faea90e50e376ee0edbbd1005160a3063a0aea1dc7bcf1da8774f9
SSDEEP 49152:w/OJD55YyOYPNgzNGEADt7i+/yTukuFGNLrkBirx:EOuyOYPNUchrSiGdkBirx
TLSH
T14006931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4360	1DA0.tmp
2828	1E8A.tmp
1292	238C.tmp
4884	2774.tmp
4312	29F4.tmp
3184	2C85.tmp
2056	2F63.tmp
5544	3270.tmp
5728	3520.tmp
3112	37CF.tmp
5000	3B2B.tmp
2124	3DEA.tmp
304	40A9.tmp
3144	4368.tmp
4548	4637.tmp
2772	48C7.tmp
5684	4B57.tmp
1420	4E16.tmp
2640	50F5.tmp
4504	53A4.tmp
2328	5673.tmp
2400	5942.tmp
1252	5AE8.tmp
4440	5E33.tmp
1132	60D3.tmp
5816	6392.tmp
1000	6632.tmp
4640	68D2.tmp
3560	6B82.tmp
1016	6E31.tmp
1056	6F98.tmp
576	7323.tmp
2528	75C3.tmp
1080	76BD.tmp
2820	77E5.tmp
5244	78C0.tmp
2716	79AB.tmp
1676	7AE3.tmp
3956	7C2B.tmp
2888	7D44.tmp
3348	7E3E.tmp
3372	7F38.tmp
3400	8004.tmp
4472	811D.tmp
2004	8226.tmp
4432	8320.tmp
5024	8478.tmp
3096	8563.tmp
4204	865D.tmp
2188	8718.tmp
3232	87E3.tmp
2708	88AE.tmp
4220	8979.tmp
3008	8A45.tmp
5908	8B00.tmp
4100	8BFA.tmp
4292	8CD5.tmp
5948	8D90.tmp
3420	8E6B.tmp
3000	8F27.tmp
4268	9001.tmp
1428	90CC.tmp
5764	9188.tmp
2460	9253.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE6F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2358.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71C6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D87F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	564A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CD87.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2665.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	494F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	761C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2288.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B30A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6255.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	639D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	558F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DE9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C499.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F500.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BBD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4603.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6311.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9C80.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	146F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F79.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45B0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A445.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81F3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEE8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EA42.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDFB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBF5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B86.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9CC3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F999.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B26.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4255.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA40.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AB0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5209.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F464.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C76D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBD0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3049.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68FC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D0C3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D68.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27C8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA0A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24DF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58D0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8687.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	904B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B56B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35A8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9636.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD39.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60D3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94E3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	959F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6E0D.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4360	2836	2026-08-13_63a966826254dc6120c13b0374eb2f57_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4360 wrote to memory of 2828	4360	1DA0.tmp	90
PID 2828 wrote to memory of 1292	2828	1E8A.tmp	91
PID 1292 wrote to memory of 4884	1292	238C.tmp	92
PID 4884 wrote to memory of 4312	4884	2774.tmp	93
PID 4312 wrote to memory of 3184	4312	29F4.tmp	94
PID 3184 wrote to memory of 2056	3184	2C85.tmp	95
PID 2056 wrote to memory of 5544	2056	2F63.tmp	96
PID 5544 wrote to memory of 5728	5544	3270.tmp	97
PID 5728 wrote to memory of 3112	5728	3520.tmp	98
PID 3112 wrote to memory of 5000	3112	37CF.tmp	99
PID 5000 wrote to memory of 2124	5000	3B2B.tmp	100
PID 2124 wrote to memory of 304	2124	3DEA.tmp	101
PID 304 wrote to memory of 3144	304	40A9.tmp	102
PID 3144 wrote to memory of 4548	3144	4368.tmp	103
PID 4548 wrote to memory of 2772	4548	4637.tmp	104
PID 2772 wrote to memory of 5684	2772	48C7.tmp	105
PID 5684 wrote to memory of 1420	5684	4B57.tmp	106
PID 1420 wrote to memory of 2640	1420	4E16.tmp	107
PID 2640 wrote to memory of 4504	2640	50F5.tmp	108
PID 4504 wrote to memory of 2328	4504	53A4.tmp	109
PID 2328 wrote to memory of 2400	2328	5673.tmp	110
PID 2400 wrote to memory of 1252	2400	5942.tmp	111
PID 1252 wrote to memory of 4440	1252	5AE8.tmp	112
PID 4440 wrote to memory of 1132	4440	5E33.tmp	113
PID 1132 wrote to memory of 5816	1132	60D3.tmp	114
PID 5816 wrote to memory of 1000	5816	6392.tmp	115
PID 1000 wrote to memory of 4640	1000	6632.tmp	116
PID 4640 wrote to memory of 3560	4640	68D2.tmp	117
PID 3560 wrote to memory of 1016	3560	6B82.tmp	118
PID 1016 wrote to memory of 1056	1016	6E31.tmp	119
PID 1056 wrote to memory of 576	1056	6F98.tmp	120
PID 576 wrote to memory of 2528	576	7323.tmp	121
PID 2528 wrote to memory of 1080	2528	75C3.tmp	122
PID 1080 wrote to memory of 2820	1080	76BD.tmp	123
PID 2820 wrote to memory of 5244	2820	77E5.tmp	124
PID 5244 wrote to memory of 2716	5244	78C0.tmp	125
PID 2716 wrote to memory of 1676	2716	79AB.tmp	126
PID 1676 wrote to memory of 3956	1676	7AE3.tmp	127
PID 3956 wrote to memory of 2888	3956	7C2B.tmp	128
PID 2888 wrote to memory of 3348	2888	7D44.tmp	129
PID 3348 wrote to memory of 3372	3348	7E3E.tmp	130
PID 3372 wrote to memory of 3400	3372	7F38.tmp	131
PID 3400 wrote to memory of 4472	3400	8004.tmp	132
PID 4472 wrote to memory of 2004	4472	811D.tmp	133
PID 2004 wrote to memory of 4432	2004	8226.tmp	134
PID 4432 wrote to memory of 5024	4432	8320.tmp	135
PID 5024 wrote to memory of 3096	5024	8478.tmp	136
PID 3096 wrote to memory of 4204	3096	8563.tmp	137
PID 4204 wrote to memory of 2188	4204	865D.tmp	138
PID 2188 wrote to memory of 3232	2188	8718.tmp	139
PID 3232 wrote to memory of 2708	3232	87E3.tmp	140
PID 2708 wrote to memory of 4220	2708	88AE.tmp	141
PID 4220 wrote to memory of 3008	4220	8979.tmp	142
PID 3008 wrote to memory of 5908	3008	8A45.tmp	143
PID 5908 wrote to memory of 4100	5908	8B00.tmp	144
PID 4100 wrote to memory of 4292	4100	8BFA.tmp	145
PID 4292 wrote to memory of 5948	4292	8CD5.tmp	146
PID 5948 wrote to memory of 3420	5948	8D90.tmp	147
PID 3420 wrote to memory of 3000	3420	8E6B.tmp	148
PID 3000 wrote to memory of 4268	3000	8F27.tmp	149
PID 4268 wrote to memory of 1428	4268	9001.tmp	151
PID 1428 wrote to memory of 5764	1428	90CC.tmp	152
PID 5764 wrote to memory of 2460	5764	9188.tmp	153

C:\Users\Admin\AppData\Local\Temp\2026-08-13_63a966826254dc6120c13b0374eb2f57_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_63a966826254dc6120c13b0374eb2f57_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\1DA0.tmp
  "C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Users\Admin\AppData\Local\Temp\1E8A.tmp
    "C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\238C.tmp
      "C:\Users\Admin\AppData\Local\Temp\238C.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\2774.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2774.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\29F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29F4.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\2C85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C85.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\2F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F63.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\3270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3270.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\3520.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3520.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\37CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37CF.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\3B2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\3DEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\40A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40A9.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\4368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4368.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\4637.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4637.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\48C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48C7.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\4B57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B57.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\4E16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E16.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\50F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50F5.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\53A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53A4.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\5673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5673.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\5942.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5942.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\5AE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\5E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E33.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\60D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60D3.tmp"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\6392.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6392.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\6632.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6632.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\68D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68D2.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\6B82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B82.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\6E31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E31.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\6F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F98.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\7323.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7323.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\75C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75C3.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\76BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76BD.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\77E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E5.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\78C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78C0.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\79AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79AB.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\7AE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\7C2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\7D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D44.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\7E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\7F38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F38.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\8004.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8004.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\811D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\811D.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\8226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8226.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\8320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8320.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\8478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8478.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\8563.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8563.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\865D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\865D.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\8718.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8718.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\87E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87E3.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\88AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88AE.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\8979.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8979.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\8A45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A45.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\8B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B00.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\8BFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\8CD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\8D90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D90.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\8E6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\8F27.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F27.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\9001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9001.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\90CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90CC.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\9188.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9188.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\9253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9253.tmp"
        65⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\932E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\932E.tmp"
        66⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\93F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93F9.tmp"
        67⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\94E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94E3.tmp"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\959F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\959F.tmp"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\967A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\967A.tmp"
        70⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\9735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9735.tmp"
        71⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\9800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9800.tmp"
        72⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\98DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98DB.tmp"
        73⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\9996.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9996.tmp"
        74⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\9A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A52.tmp"
        75⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\9B2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"
        76⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\9BD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"
        77⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\9CC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\9D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"
        79⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\9E4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"
        80⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\9F05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F05.tmp"
        81⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\9FD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"
        82⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\A07C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A07C.tmp"
        83⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\A147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A147.tmp"
        84⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\A203.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A203.tmp"
        85⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\A2BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"
        86⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\A389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A389.tmp"
        87⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\A445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A445.tmp"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\A510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A510.tmp"
        89⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\A5BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"
        90⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\A677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A677.tmp"
        91⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\A752.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A752.tmp"
        92⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\A80E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A80E.tmp"
        93⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\A8E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"
        94⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\A994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A994.tmp"
        95⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\AA40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA40.tmp"
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\AAFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"
        97⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\ABB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"
        98⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\AC92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC92.tmp"
        99⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\AD5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"
        100⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\AE47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE47.tmp"
        101⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\AF32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF32.tmp"
        102⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\AFDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"
        103⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\B0B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"
        104⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\B183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B183.tmp"
        105⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\B23F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B23F.tmp"
        106⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\B30A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B30A.tmp"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\B3E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"
        108⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\B4A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"
        109⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\B56B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B56B.tmp"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\B637.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B637.tmp"
        111⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        112⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\B7FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"
        113⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\B8B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"
        114⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\B973.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B973.tmp"
        115⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\BA3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"
        116⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\BB19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB19.tmp"
        117⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\BBF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"
        118⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\BCCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"
        119⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\BDA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"
        120⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\BE84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE84.tmp"
        121⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\BF2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"
        122⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\BFFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"
        123⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\C0D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"
        124⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\C1CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"
        125⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\C2AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"
        126⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\C375.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C375.tmp"
        127⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\C440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C440.tmp"
        128⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\C4FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"
        129⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\C5E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"
        130⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\C692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C692.tmp"
        131⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\C76D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C76D.tmp"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\C867.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C867.tmp"
        133⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\C932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C932.tmp"
        134⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\CA0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"
        135⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\CAE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"
        136⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\CBB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"
        137⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\CC9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"
        138⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\CD87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD87.tmp"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\CE52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE52.tmp"
        140⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\CF2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"
        141⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\CFF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"
        142⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\D0C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\D1AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"
        144⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\D269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D269.tmp"
        145⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\D344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D344.tmp"
        146⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\D42E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D42E.tmp"
        147⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\D528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D528.tmp"
        148⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\D5E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"
        149⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\D6BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"
        150⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\D799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D799.tmp"
        151⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\D855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D855.tmp"
        152⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\D930.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D930.tmp"
        153⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\DA0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\DAE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"
        155⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\DBD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\DCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"
        157⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\DD85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD85.tmp"
        158⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\DE6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\DF5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"
        160⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\E025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E025.tmp"
        161⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\E0F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"
        162⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\E1BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"
        163⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\E2B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"
        164⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\E390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E390.tmp"
        165⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\E47A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E47A.tmp"
        166⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\E526.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E526.tmp"
        167⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\E601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E601.tmp"
        168⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\E6DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"
        169⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\E797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E797.tmp"
        170⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\E862.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E862.tmp"
        171⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\E93D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E93D.tmp"
        172⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\EA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA18.tmp"
        173⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\EAF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"
        174⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\EBBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"
        175⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\EC89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC89.tmp"
        176⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\ED64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED64.tmp"
        177⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\EE4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"
        178⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\EF09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF09.tmp"
        179⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\EFD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"
        180⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\F0A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"
        181⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\F17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F17A.tmp"
        182⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\F246.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F246.tmp"
        183⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\F340.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F340.tmp"
        184⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\F40B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F40B.tmp"
        185⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\F4B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"
        186⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\F5A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"
        187⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\F65C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F65C.tmp"
        188⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\F728.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F728.tmp"
        189⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\F812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F812.tmp"
        190⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\F8ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"
        191⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\F999.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F999.tmp"
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\FA93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA93.tmp"
        193⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\FB5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"
        194⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\FC0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"
        195⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\FCE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"
        196⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\FDAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"
        197⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\FE7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"
        198⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\FF65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF65.tmp"
        199⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20.tmp"
        200⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC.tmp"
        201⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\1D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D6.tmp"
        202⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        203⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\34D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D.tmp"
        204⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418.tmp"
        205⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\4E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E3.tmp"
        206⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\5BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BE.tmp"
        207⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\66A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66A.tmp"
        208⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\764.tmp"
        209⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\81F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81F.tmp"
        210⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\8FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FA.tmp"
        211⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\9C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C5.tmp"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\AB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB0.tmp"
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\B7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7B.tmp"
        214⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\C55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C55.tmp"
        215⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\D40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D40.tmp"
        216⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1B.tmp"
        217⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF5.tmp"
        218⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\FE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE0.tmp"
        219⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\108C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\108C.tmp"
        220⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\1166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1166.tmp"
        221⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\1222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1222.tmp"
        222⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\12DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12DD.tmp"
        223⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\13B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13B8.tmp"
        224⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\1493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1493.tmp"
        225⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\153F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\153F.tmp"
        226⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\1639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1639.tmp"
        227⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\16F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16F4.tmp"
        228⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\17BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17BF.tmp"
        229⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\189A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\189A.tmp"
        230⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\1965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1965.tmp"
        231⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\1A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A30.tmp"
        232⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\1AFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"
        233⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\1BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"
        234⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\1CA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"
        235⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\1D5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"
        236⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\1E18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E18.tmp"
        237⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\1ED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"
        238⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\1F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"
        239⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\205A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\205A.tmp"
        240⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\2116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2116.tmp"
        241⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\21E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21E1.tmp"
        242⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\229D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\229D.tmp"
        243⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\2358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2358.tmp"
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\2423.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2423.tmp"
        245⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\24DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24DF.tmp"
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\25AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25AA.tmp"
        247⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\2665.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2665.tmp"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\2721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2721.tmp"
        249⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\281B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\281B.tmp"
        250⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\28B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28B7.tmp"
        251⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\2992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2992.tmp"
        252⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\2A3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"
        253⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\2AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"
        254⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\2BB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"
        255⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\2C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C70.tmp"
        256⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\2D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"
        257⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\2DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"
        258⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\2EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"
        259⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\2FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FAC.tmp"
        260⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\3049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3049.tmp"
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\3123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3123.tmp"
        262⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\31CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31CF.tmp"
        263⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\328B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\328B.tmp"
        264⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\3337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3337.tmp"
        265⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\3402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3402.tmp"
        266⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\34CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34CD.tmp"
        267⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\35A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35A8.tmp"
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\3663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3663.tmp"
        269⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\371F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\371F.tmp"
        270⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\37CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37CA.tmp"
        271⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\38A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38A5.tmp"
        272⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\3961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3961.tmp"
        273⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\3A0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"
        274⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\3AC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"
        275⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\3B84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B84.tmp"
        276⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\3C4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"
        277⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\3D0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D0A.tmp"
        278⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\3DC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DC6.tmp"
        279⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\3E91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E91.tmp"
        280⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\3F5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"
        281⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\4027.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4027.tmp"
        282⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\40D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40D3.tmp"
        283⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\419E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\419E.tmp"
        284⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\4279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4279.tmp"
        285⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\4325.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4325.tmp"
        286⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\43F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43F0.tmp"
        287⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\44AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44AB.tmp"
        288⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\4557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4557.tmp"
        289⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\4603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4603.tmp"
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\46ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46ED.tmp"
        291⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\4799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4799.tmp"
        292⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\4864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4864.tmp"
        293⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\494F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\494F.tmp"
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\49EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49EB.tmp"
        295⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\4AC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"
        296⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\4B72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B72.tmp"
        297⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\4C1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C1E.tmp"
        298⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\4CC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"
        299⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\4D85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D85.tmp"
        300⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\4E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E21.tmp"
        301⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\4F0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"
        302⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\4FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"
        303⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\5083.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5083.tmp"
        304⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\514E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\514E.tmp"
        305⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\5209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5209.tmp"
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\52F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52F4.tmp"
        307⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\5390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5390.tmp"
        308⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\544B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\544B.tmp"
        309⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        310⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\55C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55C2.tmp"
        311⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\566E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\566E.tmp"
        312⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\571A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\571A.tmp"
        313⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\57D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57D6.tmp"
        314⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\58D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58D0.tmp"
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\598B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\598B.tmp"
        316⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\5A47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A47.tmp"
        317⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\5B12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B12.tmp"
        318⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\5BEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"
        319⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\5C89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C89.tmp"
        320⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\5D35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D35.tmp"
        321⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\5E0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"
        322⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\5EAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EAC.tmp"
        323⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\5F77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F77.tmp"
        324⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\6042.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6042.tmp"
        325⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\60DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60DE.tmp"
        326⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\61A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61A9.tmp"
        327⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\6255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6255.tmp"
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\6311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6311.tmp"
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\639D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\639D.tmp"
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\6478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6478.tmp"
        331⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\6524.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6524.tmp"
        332⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\660E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\660E.tmp"
        333⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\66CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66CA.tmp"
        334⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\6785.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6785.tmp"
        335⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\6821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6821.tmp"
        336⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\68FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68FC.tmp"
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\69A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69A8.tmp"
        338⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\6A64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A64.tmp"
        339⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\6B2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B2F.tmp"
        340⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\6BDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"
        341⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\6CA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"
        342⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\6D61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D61.tmp"
        343⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\6E0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E0D.tmp"
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\6EE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EE8.tmp"
        345⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\6FB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"
        346⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\704F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\704F.tmp"
        347⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\70FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70FB.tmp"
        348⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\71C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71C6.tmp"
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\7272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7272.tmp"
        350⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\731E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\731E.tmp"
        351⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\73D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73D9.tmp"
        352⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\74A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74A5.tmp"
        353⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\7560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7560.tmp"
        354⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\761C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\761C.tmp"
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\76E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76E7.tmp"
        356⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\77A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77A2.tmp"
        357⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\784E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\784E.tmp"
        358⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\790A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\790A.tmp"
        359⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\79B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79B5.tmp"
        360⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\7A81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A81.tmp"
        361⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\7F14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F14.tmp"
        362⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\7FE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"
        363⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\808B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\808B.tmp"
        364⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\8137.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8137.tmp"
        365⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\81F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81F3.tmp"
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\82BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82BE.tmp"
        367⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\8399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8399.tmp"
        368⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\8473.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8473.tmp"
        369⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\8510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8510.tmp"
        370⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\85BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85BC.tmp"
        371⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\8687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8687.tmp"
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\8742.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8742.tmp"
        373⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\881D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\881D.tmp"
        374⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\88C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88C9.tmp"
        375⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\8965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8965.tmp"
        376⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\8A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A30.tmp"
        377⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\8AEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"
        378⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\8BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"
        379⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\8C72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C72.tmp"
        380⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\8D1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"
        381⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\8DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\8EA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA5.tmp"
        383⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\8F60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F60.tmp"
        384⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\904B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\904B.tmp"
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\90E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90E7.tmp"
        386⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\91B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91B2.tmp"
        387⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\927D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\927D.tmp"
        388⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\9348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9348.tmp"
        389⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\93E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E5.tmp"
        390⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\94B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B0.tmp"
        391⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\956B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\956B.tmp"
        392⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\9636.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9636.tmp"
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\96D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96D3.tmp"
        394⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\978E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\978E.tmp"
        395⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\984A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\984A.tmp"
        396⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\98F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98F5.tmp"
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\99A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99A1.tmp"
        398⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\9A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A5D.tmp"
        399⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\9AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"
        400⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\9BB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BB5.tmp"
        401⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\9C80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C80.tmp"
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\9D4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"
        403⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\9DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"
        404⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\9ED1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9ED1.tmp"
        405⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\9F8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"
        406⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\A048.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A048.tmp"
        407⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\A104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A104.tmp"
        408⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\A1B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"
        409⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\A28B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A28B.tmp"
        410⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\A356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A356.tmp"
        411⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\A402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A402.tmp"
        412⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\A4CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"
        413⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\A5A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"
        414⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\A663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A663.tmp"
        415⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\A71E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A71E.tmp"
        416⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\A7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7F9.tmp"
        417⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\A8B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"
        418⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\A970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A970.tmp"
        419⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\AA4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA4B.tmp"
        420⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\AB16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB16.tmp"
        421⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\ABD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABD2.tmp"
        422⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\AC7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC7D.tmp"
        423⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\AD39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD39.tmp"
        424⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\ADF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADF4.tmp"
        425⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\AEA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"
        426⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\AF7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF7B.tmp"
        427⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\B037.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B037.tmp"
        428⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\B102.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B102.tmp"
        429⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\B1BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1BD.tmp"
        430⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\B279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B279.tmp"
        431⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\B325.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B325.tmp"
        432⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\B3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3F0.tmp"
        433⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\B49C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B49C.tmp"
        434⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\B557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B557.tmp"
        435⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\B613.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B613.tmp"
        436⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\B6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6CE.tmp"
        437⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\B799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B799.tmp"
        438⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\B855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B855.tmp"
        439⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\B910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B910.tmp"
        440⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\B9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9BC.tmp"
        441⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\BA68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA68.tmp"
        442⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\BB52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB52.tmp"
        443⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\BC0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC0E.tmp"
        444⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\BCC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCC9.tmp"
        445⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\BD85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD85.tmp"
        446⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\BE50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE50.tmp"
        447⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\BF0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"
        448⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\C005.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C005.tmp"
        449⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\C0B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0B1.tmp"
        450⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\C17C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C17C.tmp"
        451⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\C228.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C228.tmp"
        452⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\C2F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2F3.tmp"
        453⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\C3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3BF.tmp"
        454⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\C499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C499.tmp"
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\C564.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C564.tmp"
        456⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\C630.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C630.tmp"
        457⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\C6DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6DB.tmp"
        458⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\C7B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7B6.tmp"
        459⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\C881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C881.tmp"
        460⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\C93D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C93D.tmp"
        461⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\CA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA18.tmp"
        462⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\CAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB4.tmp"
        463⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\CB6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB6F.tmp"
        464⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\CC4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC4A.tmp"
        465⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\CD15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD15.tmp"
        466⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\CDE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDE0.tmp"
        467⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\CE9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE9C.tmp"
        468⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        469⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\D061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D061.tmp"
        470⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\D15B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D15B.tmp"
        471⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\D216.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D216.tmp"
        472⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\D2F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F1.tmp"
        473⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\D3CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3CC.tmp"
        474⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\D4B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4B6.tmp"
        475⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\D591.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D591.tmp"
        476⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\D64D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D64D.tmp"
        477⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\D708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D708.tmp"
        478⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\D7C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7C4.tmp"
        479⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\D87F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D87F.tmp"
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\D95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D95A.tmp"
        481⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\DA15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA15.tmp"
        482⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\DAF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAF0.tmp"
        483⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\DB9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB9C.tmp"
        484⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\DC96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC96.tmp"
        485⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\DD61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD61.tmp"
        486⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\DE1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE1D.tmp"
        487⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\DEE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEE8.tmp"
        488⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\DFB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFB3.tmp"
        489⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\E05F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E05F.tmp"
        490⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\E149.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E149.tmp"
        491⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\E214.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E214.tmp"
        492⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\E31E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E31E.tmp"
        493⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\E3F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"
        494⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\E4D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"
        495⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\E59E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E59E.tmp"
        496⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\E63B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E63B.tmp"
        497⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\E706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E706.tmp"
        498⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\E7E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7E1.tmp"
        499⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\E8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8AC.tmp"
        500⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\E958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E958.tmp"
        501⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\EA42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA42.tmp"
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\EB0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB0D.tmp"
        503⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\EBC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBC9.tmp"
        504⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\EC74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC74.tmp"
        505⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\ED4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED4F.tmp"
        506⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\EDFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDFB.tmp"
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\EEC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEC6.tmp"
        508⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\EF72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF72.tmp"
        509⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\F01E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F01E.tmp"
        510⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\F108.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F108.tmp"
        511⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\F1C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1C4.tmp"
        512⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\F2AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2AE.tmp"
        513⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\F379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F379.tmp"
        514⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\F464.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F464.tmp"
        515⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\F500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F500.tmp"
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\F5EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5EA.tmp"
        517⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\F6B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6B5.tmp"
        518⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\F761.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F761.tmp"
        519⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\F81D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F81D.tmp"
        520⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\F8D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8D8.tmp"
        521⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\F994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F994.tmp"
        522⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\FA7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA7E.tmp"
        523⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\FB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB49.tmp"
        524⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\FBF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBF5.tmp"
        525⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\FCB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCB1.tmp"
        526⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\FD6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD6C.tmp"
        527⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\FE28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE28.tmp"
        528⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\FEE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEE3.tmp"
        529⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\FFBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFBE.tmp"
        530⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89.tmp"
        531⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\145.tmp"
        532⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\1F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F0.tmp"
        533⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\2BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\3A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A6.tmp"
        535⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\461.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\461.tmp"
        536⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\50D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50D.tmp"
        537⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\5C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C9.tmp"
        538⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\694.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\694.tmp"
        539⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\740.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\740.tmp"
        540⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\7EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EC.tmp"
        541⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\8A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A7.tmp"
        542⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\953.tmp"
        543⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\A1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1E.tmp"
        544⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\ABA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA.tmp"
        545⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B86.tmp"
        546⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\C31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C31.tmp"
        547⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\D0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0C.tmp"
        548⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\DB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB8.tmp"
        549⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\E83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E83.tmp"
        550⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\F4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4E.tmp"
        551⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\100A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\100A.tmp"
        552⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\10C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10C5.tmp"
        553⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\1171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1171.tmp"
        554⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\122D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\122D.tmp"
        555⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\1307.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1307.tmp"
        556⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\13C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13C3.tmp"
        557⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\146F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\146F.tmp"
        558⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\152A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\152A.tmp"
        559⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\15E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15E6.tmp"
        560⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\16B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16B1.tmp"
        561⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\176C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\176C.tmp"
        562⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\1828.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1828.tmp"
        563⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\18E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18E3.tmp"
        564⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\199F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\199F.tmp"
        565⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\1A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A7A.tmp"
        566⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\1B26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B26.tmp"
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\1BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BF1.tmp"
        568⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\1C9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C9D.tmp"
        569⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\1D68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D68.tmp"
        570⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\1E52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E52.tmp"
        571⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\1EFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EFE.tmp"
        572⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\1FB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FB9.tmp"
        573⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\2065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2065.tmp"
        574⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\2121.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2121.tmp"
        575⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\21CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21CD.tmp"
        576⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\2288.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2288.tmp"
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\2334.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2334.tmp"
        578⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\23E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23E0.tmp"
        579⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\24DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24DA.tmp"
        580⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\2586.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2586.tmp"
        581⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\2632.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2632.tmp"
        582⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\26FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26FD.tmp"
        583⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\27C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27C8.tmp"
        584⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\2874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2874.tmp"
        585⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\294F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\294F.tmp"
        586⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\29FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29FA.tmp"
        587⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\2AB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AB6.tmp"
        588⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\2B81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B81.tmp"
        589⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\2C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C2D.tmp"
        590⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\2CE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CE8.tmp"
        591⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\2DD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DD3.tmp"
        592⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\2E7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E7F.tmp"
        593⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\2F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F79.tmp"
        594⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\3025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3025.tmp"
        595⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\30D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30D0.tmp"
        596⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\318C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\318C.tmp"
        597⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\3276.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3276.tmp"
        598⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\3313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3313.tmp"
        599⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\33DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33DE.tmp"
        600⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\347A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\347A.tmp"
        601⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\3555.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3555.tmp"
        602⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\35F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35F1.tmp"
        603⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\36BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36BC.tmp"
        604⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3768.tmp"
        605⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\3823.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3823.tmp"
        606⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\38EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38EF.tmp"
        607⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\39AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39AA.tmp"
        608⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\3A46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A46.tmp"
        609⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\3B11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B11.tmp"
        610⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\3BBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BBD.tmp"
        611⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\3C69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C69.tmp"
        612⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\3D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D25.tmp"
        613⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\3DF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DF0.tmp"
        614⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\3E7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E7C.tmp"
        615⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\3F57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F57.tmp"
        616⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\4013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4013.tmp"
        617⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\40CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40CE.tmp"
        618⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\417A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417A.tmp"
        619⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\4255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4255.tmp"
        620⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\4301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4301.tmp"
        621⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\43AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43AD.tmp"
        622⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\4468.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4468.tmp"
        623⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\4514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4514.tmp"
        624⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\45B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45B0.tmp"
        625⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\466C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\466C.tmp"
        626⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\4727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4727.tmp"
        627⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\47E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47E3.tmp"
        628⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\48BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48BD.tmp"
        629⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\4989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4989.tmp"
        630⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\4A34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A34.tmp"
        631⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\4AE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AE0.tmp"
        632⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\4BAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BAB.tmp"
        633⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\4C67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C67.tmp"
        634⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\4D13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D13.tmp"
        635⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\4DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DEE.tmp"
        636⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\4EC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EC8.tmp"
        637⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\4F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F74.tmp"
        638⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\505F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\505F.tmp"
        639⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\50FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50FB.tmp"
        640⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\51D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51D6.tmp"
        641⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\5291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5291.tmp"
        642⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\535C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\535C.tmp"
        643⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\5418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5418.tmp"
        644⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\54C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54C4.tmp"
        645⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\558F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\558F.tmp"
        646⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\564A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\564A.tmp"
        647⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\56F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56F6.tmp"
        648⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\57B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57B2.tmp"
        649⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\585D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\585D.tmp"
        650⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\5929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5929.tmp"
        651⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\59E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59E4.tmp"
        652⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\5A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A90.tmp"
        653⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\5B4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B4B.tmp"
        654⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\5C07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C07.tmp"
        655⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\5CC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CC2.tmp"
        656⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\5D7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D7E.tmp"
        657⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\5E49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E49.tmp"
        658⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\5F05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F05.tmp"
        659⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\5FD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FD0.tmp"
        660⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\608B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\608B.tmp"
        661⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\6137.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6137.tmp"
        662⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\6202.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6202.tmp"
        663⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\62BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62BE.tmp"
        664⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\6379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6379.tmp"
        665⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\6435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6435.tmp"
        666⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\650F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\650F.tmp"
        667⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\65BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65BB.tmp"
        668⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\6686.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6686.tmp"
        669⤵
        
        PID:6288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1DA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\1DA0.tmp
Size 3.6MB
SHA256 07fcda4323c202a8cb679279dcac5c0aa3bc7d4dbe87b7f2235c92f8ab7b610a
MD5 f5dbe1e4b9fcafaedc0c702b275e42e7
SHA1 c97007290b1c274dc1af255362139ba0b4b8fd23
SHA512 5487fdaf0dd67a5ce6e07c32e3f9995d18f63131f5c5ba895888b1af6b54aa9079bd7af797c8c11671c23ca6d5d07b0d6555b2be307d1de5f80e160ef1756d70
SSDEEP 49152:w/OJDPF4ylarNGEADt7i+/yTukuFGNLrkBirx:EO9qsarchrSiGdkBirx
TLSH
T15E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1E8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E8A.tmp
Size 3.6MB
SHA256 a2ab3fac86ab2b9c95edd6e22401e13eef547857c9b4092e9fe3380a6cfaa387
MD5 88bba32f90b314259e5b3e56340a6c7a
SHA1 731a8034e78e844666182878d7674867a85a5137
SHA512 3e4af93b7b71fbf23461d98cafd894c53a8b18a032f1975a1707d9f4ef65847444fbcdeb75584cf8c2e8ea9ac983e4b6b4eee523a7840b7f20efade0fc9d3458
SSDEEP 49152:w/OJDTgDTrAYNGEADt7i+/yTukuFGNLrkBirx:EORgDTEYchrSiGdkBirx
TLSH
T19806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

238C.tmp

Path C:\Users\Admin\AppData\Local\Temp\238C.tmp
Size 3.6MB
SHA256 6fbe5c971430f011af929cf08ab33a8c08a376f35bf71a8773e3fb1ec3869edd
MD5 9d5f67c59104c72ce758a90865dc1681
SHA1 bdce5bbe9f14ada77ae8422a2a297da922a6b9d2
SHA512 70da69266fa057a681dcb16636baa117c06b17d6641cb961b48871a897ab5523d07531baab5d0bfad706c986719f0574dfaafef8b29efffeb56b61dc02dc2561
SSDEEP 49152:w/OJD+qZ+NGEADt7i+/yTukuFGNLrkBirx:EOCchrSiGdkBirx
TLSH
T14F06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2774.tmp

Path C:\Users\Admin\AppData\Local\Temp\2774.tmp
Size 3.6MB
SHA256 5fede139cdcfa395dc25b92a341bf00a118e167ebe9230d4310fafb5fbcef29b
MD5 b266aa6b402558d0b64903361f717c99
SHA1 10c5e8e6ab24937d8e3d88688a336cfaf57018ac
SHA512 8a54a756dc79df6cc35b5048e4eac44e0cd21397476af43c001ae6678facc8c092f55cc5aedd5f4de810ba5c7925852b4fafc67987b2786107383739959ebe17
SSDEEP 49152:w/OJDSCpdO8NGEADt7i+/yTukuFGNLrkBirx:EOLdFchrSiGdkBirx
TLSH
T1F206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\29F4.tmp
Size 3.6MB
SHA256 76e4b71e9966fd2b502c5f607d84f26352dd5a473cda66f2ae3419172f26768c
MD5 4ab1e000c0681600b0ebab32a0897fe8
SHA1 b7fa60a79b580ccdaa547bd2aaf5e47e373b4de4
SHA512 6ae482db566e2c2421a8d939159a9b89e7ccaf6316bd38c7fc068cf45226bb5c9f0b2b9b2fdd6dbd3b194844001bc30373175d8db2c4baeed8bb12322f6a6617
SSDEEP 24576:wUQOJDdWRLChrlNGEAFC5etW0Ri+aMyFH1K/PkuRe8GNLJhkBir2ZPevL:w/OJD3NGEADt7i+/yTukuFGNLrkBirx
TLSH
T1E606831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2C85.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C85.tmp
Size 3.6MB
SHA256 f7139148b843e9d70efb37b3c7cfd1d3b4bc4c894ba24f245c20a7d269a6f6dc
MD5 45e2849492b8728d14315af451bfcb72
SHA1 82d8da175b624973bb98fb29d669abf19bf8284e
SHA512 5ddb590a8a9df58e5d73253b8d5ece351bbe4d254ae653deb13ea1b9d0df12f143eeb72e019c10a1f37438dc0e55edc2d4b813963fd493526bda7669545dde5e
SSDEEP 49152:w/OJD84xErq5NGEADt7i+/yTukuFGNLrkBirx:EOgUchrSiGdkBirx
TLSH
T14706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2F63.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F63.tmp
Size 3.6MB
SHA256 bff11791975ac8de961de614b771503902a7ce3264ca0bcf6d0216320347f6b2
MD5 2feadfbdfcc46fcb0258c13783b66478
SHA1 18c0472c32ba363f0999a6108ddd7db5c780e272
SHA512 7b38ae2e70f3d15cb415722001f1cb83bde4802d14edf94284dc4aa39522214e7191935dcfba5155587a9b8de82dcb3df50653b8ef87352689c1b1d66549e9e8
SSDEEP 49152:w/OJD+0NGEADt7i+/yTukuFGNLrkBirx:EOQ0chrSiGdkBirx
TLSH
T18006931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3270.tmp

Path C:\Users\Admin\AppData\Local\Temp\3270.tmp
Size 3.6MB
SHA256 a1db5687087c76688c4a47cad13c70a4a542379926cb30237872121dcaf77147
MD5 2fc3ce4ed21a98672196da8b5e2d83ff
SHA1 f2c34a70cf55d2013fdd8d9334a919e17a14b25d
SHA512 1455ed99de4e3428338f664fcd7525d1289715f0d1ae53fb6eed1dbc2c1670268e72f74ed010873a9fe235962f9f70c89e29f3e463dce726f4a5e9dd4f6e63a8
SSDEEP 49152:w/OJDu0aeGNGEADt7i+/yTukuFGNLrkBirx:EOQBXchrSiGdkBirx
TLSH
T1C906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3520.tmp

Path C:\Users\Admin\AppData\Local\Temp\3520.tmp
Size 3.6MB
SHA256 3659b55414aeab417cb50e7eb7c15292e62fd25d72bd6ac0ba96f0cb75408bdc
MD5 ab7dd833837b9a1a2ef3be6bc57f6227
SHA1 e6d9c2dc93296df34d50a25a26f5cc7f7086f374
SHA512 ffbbda9c22d019bc53a859668e06fd3fba1244c5f200c6fb0b0ef76f7494b0be5f0815ec86cb1d7cb194f0f91a0ca4ebbd4b1dc4f49c50d35b6d0a7aeb92aefa
SSDEEP 49152:w/OJDWSNGEADt7i+/yTukuFGNLrkBirx:EOMSchrSiGdkBirx
TLSH
T14906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\37CF.tmp
Size 3.6MB
SHA256 e35dad6401ab4f56ae7e32e7e00ed9b1a2ee73211e06e38e6d31cef0de699239
MD5 aeb9b1a0aca082e131f625b69aa3d583
SHA1 af9171ca2fd1512f83feb1163d5d75d68dc6263d
SHA512 eded0a5f98d36237a9a9b914e64371f7b9ec744dd40c14f98a7fe3d60b82630e45c797882e5f3500586842bebe1f3e798f235d05b04aa96e66f558f731a536ab
SSDEEP 49152:w/OJDfv14XNGEADt7i+/yTukuFGNLrkBirx:EOr4XchrSiGdkBirx
TLSH
T1AD06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B2B.tmp
Size 3.6MB
SHA256 43d01756c9a1033fa35f5c06c313ce6dfeabd176609886e72eeec14660c0af9f
MD5 f6004c96ffdd9230634a51b1cb3383f7
SHA1 52d065a45f46e623e7d303c570808bd5468cc4a7
SHA512 557ad77526b9f1329d00c947dd7320c86584ab39a2de671bd67969a6a39df45039f1a5f6178b99d8bb95a36cbe97a7b9c25452eb8455c764f15e75cab5c16e66
SSDEEP 49152:w/OJDHqd0NGEADt7i+/yTukuFGNLrkBirx:EOFU0chrSiGdkBirx
TLSH
T16E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3DEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\3DEA.tmp
Size 3.6MB
SHA256 26217170190a1296d9e001d9a8a67ad22cb49e341f774910f4e7961f84c54a09
MD5 8fdd5ec4446e3f3af7ca90b2bc209d1b
SHA1 dccf44075d88ade4ce3e81af1d9c06ef3a747708
SHA512 92b323606c90d6e5b39e17505b220485e00c5df39da41d09f61935a537f0112f7bf65dc631f4a4454765f8d5a7d1bcce7721efa22e4ef5f90807e50f52dc2b36
SSDEEP 49152:w/OJDzWeq0pNGEADt7i+/yTukuFGNLrkBirx:EOdpchrSiGdkBirx
TLSH
T16706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\40A9.tmp
Size 3.6MB
SHA256 256c545daa47f07bb25eb7b8f8bdb65e32c52b3caa68065bd9aa8bd1491b8f38
MD5 3fe7c4b0eac586b6ffce81c7b4d076d8
SHA1 bbaa28c5267b5665cba1e0928842337b280509a3
SHA512 6acd6f8996bac98a75116bacdc5a32c2f3813aeccfd0b7d885e86eb8038d7cb6140a23ce6edb7365d395a2838423435fac9beb9ee5843d441a92a9d85223aed3
SSDEEP 49152:w/OJDlL66FNGEADt7i+/yTukuFGNLrkBirx:EOiechrSiGdkBirx
TLSH
T1B006831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4368.tmp

Path C:\Users\Admin\AppData\Local\Temp\4368.tmp
Size 3.6MB
SHA256 15abd4eb62773c46c1679541045ff71cc53946f8f550bdb53c67b96dc83f384a
MD5 4eb4dbd402eb37c70aaa613f8240e47c
SHA1 1752e768390193d3e2f68f461e09e7a441a334bb
SHA512 6a54c75c03c6bd62fed74d1787aaee64088d5ae1545f9ff530c560b0629f11183313ae34608e566931f4c37eecb13aa63c974ddbc05a4b1b2d78dc239c69bf40
SSDEEP 49152:w/OJDI5SZdifNGEADt7i+/yTukuFGNLrkBirx:EOe5ScchrSiGdkBirx
TLSH
T17B06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4637.tmp

Path C:\Users\Admin\AppData\Local\Temp\4637.tmp
Size 3.6MB
SHA256 303fe564c549abcb10b03528992e99fb453f9c71d24ea2a985300e8aacba130f
MD5 c7a07844b3d80b787446e41d79e87da7
SHA1 bda9574c8890bd2fb70e4be48533392478dda1c7
SHA512 ca272afd79a57681a7b2fc5eac410c57621b46b99a14ab77052dbaa70e7ecc3e9b21be6358ecf3fd32c00c4441811d0f8eb04dc209535db0a22504469b6335fd
SSDEEP 49152:w/OJD5MRZsONGEADt7i+/yTukuFGNLrkBirx:EOLkjchrSiGdkBirx
TLSH
T19606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\48C7.tmp
Size 3.6MB
SHA256 96bd6790c4ba78d99fd7818780446663272ddd467628f4cc87c31d24e0c9013c
MD5 7ae7f4b59587b842c8b42971a6dc9fb8
SHA1 806e33bc320b51fa24428ce30105ebc15ac8ac3e
SHA512 c3d2de9c2ed714838713b6cba65ebd622e04006f37b131a06425bedc556bc651017f76261100de64f5d31fbfbc0fed389f718c569ccfd3fd0b0724c9c58e7935
SSDEEP 49152:w/OJD7WXJAA4UBNGEADt7i+/yTukuFGNLrkBirx:EOjAxchrSiGdkBirx
TLSH
T1B006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4B57.tmp

Path C:\Users\Admin\AppData\Local\Temp\4B57.tmp
Size 3.6MB
SHA256 fb26113241f8db94f9a1be293d932973a86fb895fb587e583e8d5e7627621976
MD5 3dd5f6839dc305f20d90a19d06dcc12d
SHA1 848e8f87c558d75f2da616d41e8d18f064d942ea
SHA512 7a4ef0819b876c30709cdf1cdd954b841e55ae4f0810cad73948d02bbf867f321d6b706a361b30f5b4ed93e979e036f0f41083d9f04a3a5c4b2feab205d55c5f
SSDEEP 49152:w/OJDsgUC3NGEADt7i+/yTukuFGNLrkBirx:EOqgUC3chrSiGdkBirx
TLSH
T17206831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E16.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E16.tmp
Size 3.6MB
SHA256 b5c3c83dc33b05b7ef52f351be2362278b7158bc1197f8e65bc74e355444c865
MD5 a08c1df6fe18499b14df4ea996f26eb8
SHA1 457eaf0d9d45641aba0796262d0c34a573f16962
SHA512 e4e7c4517f6125695e00358438bef819b9067d2ee7f99ad1d75b173ab9387cb041c82db21da645663f6bb8f9758808e3354f2f7cf56e9db52058ed217344bf8e
SSDEEP 49152:w/OJDBV5KNGEADt7i+/yTukuFGNLrkBirx:EOGchrSiGdkBirx
TLSH
T18006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\50F5.tmp
Size 3.6MB
SHA256 3c51ff809189d5905f8d427c991660a85d86c500c8a4156b692b7eafe7d87c8b
MD5 2c7f275f486a592cafbf68c2fbfcc5b1
SHA1 7f9e84b0ddc9b1bdde0bcf0ad9b683c28ae4e493
SHA512 cdc7180066c2aa52908b5d09e18b3cc0c7bf9d558997e35cc0f56ba09972c9a75ebbf57130762380970a2d9f6909fa1d01d8249f724f34663116b1a207ae2da5
SSDEEP 49152:w/OJD6E50CNGEADt7i+/yTukuFGNLrkBirx:EOxchrSiGdkBirx
TLSH
T1CC06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\53A4.tmp
Size 3.6MB
SHA256 0b2d746dfb62872650de71aa7cdd22a5a2aaccf5ee9c4cbb8b5984bbc470a06a
MD5 a940ea5c0b4dcb2112e3bb6e4edf296a
SHA1 dfcadbaf3fde7e4bb31bcc88dcdd41ef7dd9b5a8
SHA512 9daf965b9bb1bb4ddfeb2948cb3020df89e4ab1ef8a301c1dd08d21794115ded7affe0e464ed790f70e982232f2ed1f93f788fd36d276eb926feefee8a11d34d
SSDEEP 49152:w/OJD8+xh0wFNGEADt7i+/yTukuFGNLrkBirx:EOW+X0wFchrSiGdkBirx
TLSH
T19206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5673.tmp

Path C:\Users\Admin\AppData\Local\Temp\5673.tmp
Size 3.6MB
SHA256 7da39eab66139007bfb6129653d5e13f33c36caa8ebe02ee741416373bc1f73f
MD5 338a24a4e2b44f41cef9315a62c8a73d
SHA1 cc162d66f7412552e328018019cbad5bf812311e
SHA512 89fe9682eb2040c90355e602ca863ced864f635c6c729d8e5b8f829edf74df90bf9189382f15f17295d5ceecdc1f15f0e539623cb937669fd02fa00f84354ec9
SSDEEP 49152:w/OJD5wur6/KE4NGEADt7i+/yTukuFGNLrkBirx:EOjw3/KE4chrSiGdkBirx
TLSH
T11706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5942.tmp

Path C:\Users\Admin\AppData\Local\Temp\5942.tmp
Size 3.6MB
SHA256 f08c2520256fbd9093b8e836176a117f5d107b37127d20d31a2ba7c649e9aeb5
MD5 78d241048a2b29a997e7f87fec2a32a2
SHA1 7fc0d79d64e1aa66839c69e6ea2b5b09a085400f
SHA512 4f9ae2e218861f1bdc5e96f75834aa57beabdfadd343ba0f4e40ed364cd334c4b3d96458b78f00666ec98ab7b5605c32f2ff0264031f763ba626b8c709a04c4f
SSDEEP 49152:w/OJDXp4sCNGEADt7i+/yTukuFGNLrkBirx:EOJichrSiGdkBirx
TLSH
T15706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\5AE8.tmp
Size 3.6MB
SHA256 5e4863c10b16ac63ea410b7d79c6108a4e7b6ef1d2008646e73db08ff0764141
MD5 dc6399f6c094bc7d9e29a5e8fd649bdf
SHA1 a4319fe99211c3e0c5914bfbf455d7fff7f00fc9
SHA512 fa9991de62bf05b0de2028b005a1dac00220b4e33d4bf5c1b048eb6d21b2761b6bfd46c4f4a1952eefee1e39e2af284f418831785ce36200875afeaf5bec4966
SSDEEP 49152:w/OJDiOxo9fvsHzBNGEADt7i+/yTukuFGNLrkBirx:EOCIBchrSiGdkBirx
TLSH
T1E806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E33.tmp

Path C:\Users\Admin\AppData\Local\Temp\5E33.tmp
Size 3.6MB
SHA256 87ce9620d2665c948ccbe75c557320127a55b0c1deb5a73e45e5b0bdd399e94d
MD5 f1efb2176a518a5c297afa1587344c91
SHA1 dc491ff2b2fbc89896cc10fa8ea3068df4e9d885
SHA512 5d418847936916d3de52b56f9a2dbf9bea098974d8d36413a4eae48bb2b0867e583666cd93f619e721a3b9f2637ce47c2c67f01b7258bfc91a4b6e6887cb05d5
SSDEEP 49152:w/OJDyWUKOyYVNGEADt7i+/yTukuFGNLrkBirx:EOsnKOyochrSiGdkBirx
TLSH
T11B06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\60D3.tmp
Size 3.6MB
SHA256 3d91fada9dd986f693bb84683f6c38e092ba85f51a75af7b39cb530001f94a41
MD5 222001a3ad75fe4897ef7dcebd6eb0a1
SHA1 1b782ecac413067ecb814739b477beab7e9bf319
SHA512 e7456f2b75f8520ecb4157d17e622f3f95d4abbd241a8ca771a96911803913ae21dee978d327bcb26fc4a993afc9a6702c0516a949590ed29f2af61f0d2b60f4
SSDEEP 49152:w/OJDIw7/rcuvQJNGEADt7i+/yTukuFGNLrkBirx:EOP7/rc7chrSiGdkBirx
TLSH
T1EB06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6392.tmp

Path C:\Users\Admin\AppData\Local\Temp\6392.tmp
Size 3.6MB
SHA256 d79129d085da213e0e37f44f8ae251c6bc4656b24a6d5aedfa19427914f5d31b
MD5 d095ce954e0e3ceac400670bd7772dd3
SHA1 0f72e80e93da28604f98e1574180a5c7733fdb30
SHA512 eb929b42da6a28e634c6779cd99a6b3d41951ab3ca0cf6734fb9c1cee4d515fd600e69d495ff2bc3ce568b9d9d54bb3db4741cdb79298ba2f9838f0ba948b868
SSDEEP 49152:w/OJDdiV3EHjsNGEADt7i+/yTukuFGNLrkBirx:EOuV3EDschrSiGdkBirx
TLSH
T19F06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6632.tmp

Path C:\Users\Admin\AppData\Local\Temp\6632.tmp
Size 3.6MB
SHA256 1685f67fe51c4bd5716676e1d3bf8721f2a42c4df453bb8b5d1b4df64df00430
MD5 cb0ac459e191d2350441add7ea1efc59
SHA1 a98d080fcc2189ec652b8748cad4499ec227b4c3
SHA512 c26833e5888e3a674deed6cc775d9dd200dd85d810849a2349546e2491b338c21289dc5767a3e4e263b1b751ae95909fd8165a0328f8f96fd4d805a9858739fe
SSDEEP 49152:w/OJD7oaRp/qFNGEADt7i+/yTukuFGNLrkBirx:EOmaPiFchrSiGdkBirx
TLSH
T1A406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\68D2.tmp
Size 3.6MB
SHA256 0a88da044eca7ed4c664ea7abb8b0b8104f7bae03ff214456845902380122887
MD5 2fec3811c8edba8e64fa22e9e1e161a0
SHA1 fb0a14a3290f78ea2e7d8b9318d153301f287e64
SHA512 4f917027c3c719a5a679e18e1a05620b427f74e535326fe1195c39990172b64879242e26a83761283d8a46673cb896e3f26111b1c21da02249d0d859db175db3
SSDEEP 49152:w/OJDnQC/uiANGEADt7i+/yTukuFGNLrkBirx:EONQC/EchrSiGdkBirx
TLSH
T18306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B82.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B82.tmp
Size 3.6MB
SHA256 be6ba424bc98df40c9793c1bf5dbee0d9924f8f168abb48600695041d7e00fd2
MD5 439e3168ac8a3914a94e27fd566fac77
SHA1 822e093d1ac2e46e75fb721e814abb1db9e10698
SHA512 1a86aaf30082549dfc6ad77f2011cd07bfc8fc1335af6b4092059b84a345145e364571fbdb8459b58f9648731cd77201f0e9bd6cc2e1d51b8923c7089c985475
SSDEEP 49152:w/OJDeT/TNGEADt7i+/yTukuFGNLrkBirx:EO+rchrSiGdkBirx
TLSH
T1DC06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6E31.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E31.tmp
Size 3.6MB
SHA256 3ef94994d3c318018a99f8d01f9c78efee295f1972760a8fa1b8feb14e282308
MD5 ec1f63bc1f734c78d00c32fde3535fee
SHA1 1e17a6fe0143934b69890b93eac4a062916c0715
SHA512 b1c9a7bffdebb65c82cc511b96d55cbfd346c067459d4d40bd8eaa986fdc049fbd6918739982f7dd83d666d212ac239fa79b5ad2eeb7500cc1eb487b3c2117e0
SSDEEP 49152:w/OJDzYNGEADt7i+/yTukuFGNLrkBirx:EOVYchrSiGdkBirx
TLSH
T13D06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6F98.tmp

Path C:\Users\Admin\AppData\Local\Temp\6F98.tmp
Size 3.6MB
SHA256 eb2cc78ae781dfcf829a550aac699c4cb6bdc170ed195d4bd70b5b2667a9ee75
MD5 5e832f055959a8b2ef3919800c35e353
SHA1 3dcfe13bf4e96ba9768f52fcf328175c1d92374a
SHA512 19959feea7061b8c3ee02c67026f409f7585919e6dacd9cedfe3063af71360b2339bc427992da4e5a41fdbb87b6b241e62ebb8bb1f82acb8deacb531103e62e1
SSDEEP 49152:w/OJDUAYoTNGEADt7i+/yTukuFGNLrkBirx:EOa0TchrSiGdkBirx
TLSH
T18706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7323.tmp

Path C:\Users\Admin\AppData\Local\Temp\7323.tmp
Size 3.6MB
SHA256 9dede374e73db9b415edd8c29c2846d5433d3ddbb3028db2389b7cb16ac82812
MD5 2c4c688a14e70b3e1d9c56346d64cce0
SHA1 442d79a7ac29968415ade945daae471eed4c8f1f
SHA512 167ac47873cd8eb234e449a2fab10b226344744833ded17cf1b1d2dc8e909dc959f1e9787ad668ee695567383e42fb6e02f9ad81c0172e8775c6a5b3763573ee
SSDEEP 49152:w/OJDvJ298RNGEADt7i+/yTukuFGNLrkBirx:EOa98RchrSiGdkBirx
TLSH
T1B606831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/304-96-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/304-90-0x0000000000220000-0x00000000002A3000-memory.dmp

Download

memory/576-223-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/576-229-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/1000-187-0x0000000000060000-0x00000000000E3000-memory.dmp

Download

memory/1000-195-0x0000000000060000-0x00000000000E3000-memory.dmp

Download

memory/1016-217-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/1016-209-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/1056-215-0x00000000004A0000-0x0000000000523000-memory.dmp

Download

memory/1056-222-0x00000000004A0000-0x0000000000523000-memory.dmp

Download

memory/1080-238-0x0000000000810000-0x0000000000893000-memory.dmp

Download

memory/1080-234-0x0000000000810000-0x0000000000893000-memory.dmp

Download

memory/1132-173-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/1132-180-0x0000000000240000-0x00000000002C3000-memory.dmp

Download

memory/1252-159-0x0000000000360000-0x00000000003E3000-memory.dmp

Download

memory/1252-166-0x0000000000360000-0x00000000003E3000-memory.dmp

Download

memory/1292-19-0x0000000000990000-0x0000000000A13000-memory.dmp

Download

memory/1292-26-0x0000000000990000-0x0000000000A13000-memory.dmp

Download

memory/1420-124-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/1420-131-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/1676-259-0x0000000000750000-0x00000000007D3000-memory.dmp

Download

memory/1676-253-0x0000000000750000-0x00000000007D3000-memory.dmp

Download

memory/2004-294-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/2004-288-0x0000000000D20000-0x0000000000DA3000-memory.dmp

Download

memory/2056-47-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/2056-56-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/2124-89-0x0000000000960000-0x00000000009E3000-memory.dmp

Download

memory/2124-82-0x0000000000960000-0x00000000009E3000-memory.dmp

Download

memory/2328-146-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/2328-153-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/2400-152-0x00000000003A0000-0x0000000000423000-memory.dmp

Download

memory/2400-161-0x00000000003A0000-0x0000000000423000-memory.dmp

Download

memory/2528-233-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/2528-228-0x0000000000640000-0x00000000006C3000-memory.dmp

Download

memory/2640-132-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/2640-138-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/2716-254-0x0000000000BD0000-0x0000000000C53000-memory.dmp

Download

memory/2716-248-0x0000000000BD0000-0x0000000000C53000-memory.dmp

Download

memory/2772-111-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/2772-118-0x0000000000F70000-0x0000000000FF3000-memory.dmp

Download

memory/2820-244-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/2820-239-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/2828-12-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/2828-20-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/2836-0-0x0000000000860000-0x00000000008E3000-memory.dmp

Download

memory/2836-5-0x0000000000860000-0x00000000008E3000-memory.dmp

Download

memory/2888-263-0x00000000009D0000-0x0000000000A53000-memory.dmp

Download

memory/2888-269-0x00000000009D0000-0x0000000000A53000-memory.dmp

Download

memory/3112-75-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/3112-68-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/3144-97-0x0000000000A40000-0x0000000000AC3000-memory.dmp

Download

memory/3144-105-0x0000000000A40000-0x0000000000AC3000-memory.dmp

Download

memory/3184-49-0x00000000009F0000-0x0000000000A73000-memory.dmp

Download

memory/3184-40-0x00000000009F0000-0x0000000000A73000-memory.dmp

Download

memory/3348-268-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3348-274-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/3372-273-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/3372-279-0x0000000000950000-0x00000000009D3000-memory.dmp

Download

memory/3400-278-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/3400-284-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/3560-201-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/3560-208-0x0000000000130000-0x00000000001B3000-memory.dmp

Download

memory/3956-258-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/3956-264-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/4312-42-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/4312-33-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/4360-14-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/4360-6-0x00000000006D0000-0x0000000000753000-memory.dmp

Download

memory/4432-299-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/4432-293-0x0000000000EE0000-0x0000000000F63000-memory.dmp

Download

memory/4440-174-0x0000000000090000-0x0000000000113000-memory.dmp

Download

memory/4440-167-0x0000000000090000-0x0000000000113000-memory.dmp

Download

memory/4472-289-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/4472-283-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/4504-145-0x0000000000390000-0x0000000000413000-memory.dmp

Download

memory/4504-139-0x0000000000390000-0x0000000000413000-memory.dmp

Download

memory/4548-103-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/4548-110-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/4640-202-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/4640-194-0x0000000000ED0000-0x0000000000F53000-memory.dmp

Download

memory/4884-27-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/4884-34-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/5000-83-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/5000-76-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/5024-303-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/5024-298-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/5244-249-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/5244-243-0x0000000000650000-0x00000000006D3000-memory.dmp

Download

memory/5544-54-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/5544-62-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/5684-117-0x00000000007F0000-0x0000000000873000-memory.dmp

Download

memory/5684-126-0x00000000007F0000-0x0000000000873000-memory.dmp

Download

memory/5728-69-0x0000000000E20000-0x0000000000EA3000-memory.dmp

Download

memory/5728-61-0x0000000000E20000-0x0000000000EA3000-memory.dmp

Download

memory/5816-182-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/5816-188-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads