804b85ca5ba5b7adb29b487be367037dd7ad88f1f8386faff0be2c76356beee9

Analysis

max time kernel
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0ce78feea45c5799e1cbe0afca24a0ca_elex_mafia.exe
Size 520KB
Sample260816-nt78bada66
SHA256 804b85ca5ba5b7adb29b487be367037dd7ad88f1f8386faff0be2c76356beee9
MD5 0ce78feea45c5799e1cbe0afca24a0ca
SHA1 9f2c1b35fa098f333d3d143eae5eac4ac3a2dc22
SHA512 18749b3a52160cd444b79589f0cee4018f3166c7505d2953501b5a0d41242a29bf374ef961265c2f171b32417c094de0c67dc3d2a3b84318bfbd54381ee6b91c
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL0LfP1J6Mvn0kG66ksG9CPwaODBGsH3dZE:roRXOQjmOyoH1J6oM66LG6waOJNZE
TLSH
T14FB4F022B588C032E59252314B6ACFA24B3E7D734B2656C73B94366DAEF42C1E775343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6096	16DA.tmp
4964	1803.tmp
2300	18ED.tmp
3284	19C8.tmp
5652	1A54.tmp
1096	1B9C.tmp
472	1D23.tmp
704	1DFE.tmp
5404	1EF8.tmp
3044	1FD3.tmp
4756	20AD.tmp
1656	2178.tmp
2032	2244.tmp
5864	231E.tmp
4876	23E9.tmp
5660	2495.tmp
2964	259F.tmp
272	266A.tmp
4284	2783.tmp
4748	283F.tmp
948	2929.tmp
1972	29D5.tmp
1352	2A91.tmp
1416	2BAA.tmp
4880	2CB3.tmp
5028	2DCD.tmp
4772	2EB7.tmp
3388	2F92.tmp
5112	307C.tmp
1736	3167.tmp
2132	3212.tmp
1336	331C.tmp
5560	33E7.tmp
2696	3474.tmp
1132	3500.tmp
2900	359D.tmp
2244	361A.tmp
6020	3697.tmp
6036	3733.tmp
5944	37CF.tmp
2688	386B.tmp
5228	38F8.tmp
4380	39D3.tmp
1092	3A8E.tmp
1104	3B1B.tmp
3172	3BB7.tmp
2516	3C73.tmp
5624	3D1F.tmp
5904	3DCA.tmp
3776	3E57.tmp
5708	3EE4.tmp
3100	3F80.tmp
2352	400D.tmp
5392	40A9.tmp
5556	4155.tmp
1088	41F1.tmp
2540	428D.tmp
2360	4349.tmp
4716	4404.tmp
2500	44B0.tmp
4412	452D.tmp
4508	4608.tmp
5264	46C3.tmp
5772	4750.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80F9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8488.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D930.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F91.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8A5F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD46.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2929.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5990.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	624A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91B7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D2E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B344.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D71.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92FF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFDE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3BF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F255.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5778.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9888.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B685.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4279.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EF5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8379.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3A4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B96.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EAE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA06.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1723.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	231A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	476A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	616B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	231E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33E7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CE43.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A6D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5D35.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E0F0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9E4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63AD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A00F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5673.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8A64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8F27.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D826.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13E7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E76.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48C2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DC6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6121.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7064.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D93.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B3A6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D71.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	762B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AB74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4349.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	675B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD0F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B220.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB00.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	105D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BBB0.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 6096	1184	2026-08-16_0ce78feea45c5799e1cbe0afca24a0ca_elex_mafia.exe	89
PID 6096 wrote to memory of 4964	6096	16DA.tmp	90
PID 4964 wrote to memory of 2300	4964	1803.tmp	91
PID 2300 wrote to memory of 3284	2300	18ED.tmp	92
PID 3284 wrote to memory of 5652	3284	19C8.tmp	93
PID 5652 wrote to memory of 1096	5652	1A54.tmp	94
PID 1096 wrote to memory of 472	1096	1B9C.tmp	95
PID 472 wrote to memory of 704	472	1D23.tmp	96
PID 704 wrote to memory of 5404	704	1DFE.tmp	97
PID 5404 wrote to memory of 3044	5404	1EF8.tmp	98
PID 3044 wrote to memory of 4756	3044	1FD3.tmp	99
PID 4756 wrote to memory of 1656	4756	20AD.tmp	100
PID 1656 wrote to memory of 2032	1656	2178.tmp	101
PID 2032 wrote to memory of 5864	2032	2244.tmp	102
PID 5864 wrote to memory of 4876	5864	231E.tmp	103
PID 4876 wrote to memory of 5660	4876	23E9.tmp	104
PID 5660 wrote to memory of 2964	5660	2495.tmp	105
PID 2964 wrote to memory of 272	2964	259F.tmp	106
PID 272 wrote to memory of 4284	272	266A.tmp	107
PID 4284 wrote to memory of 4748	4284	2783.tmp	108
PID 4748 wrote to memory of 948	4748	283F.tmp	109
PID 948 wrote to memory of 1972	948	2929.tmp	110
PID 1972 wrote to memory of 1352	1972	29D5.tmp	111
PID 1352 wrote to memory of 1416	1352	2A91.tmp	112
PID 1416 wrote to memory of 4880	1416	2BAA.tmp	113
PID 4880 wrote to memory of 5028	4880	2CB3.tmp	114
PID 5028 wrote to memory of 4772	5028	2DCD.tmp	115
PID 4772 wrote to memory of 3388	4772	2EB7.tmp	116
PID 3388 wrote to memory of 5112	3388	2F92.tmp	117
PID 5112 wrote to memory of 1736	5112	307C.tmp	118
PID 1736 wrote to memory of 2132	1736	3167.tmp	119
PID 2132 wrote to memory of 1336	2132	3212.tmp	120
PID 1336 wrote to memory of 5560	1336	331C.tmp	121
PID 5560 wrote to memory of 2696	5560	33E7.tmp	122
PID 2696 wrote to memory of 1132	2696	3474.tmp	123
PID 1132 wrote to memory of 2900	1132	3500.tmp	124
PID 2900 wrote to memory of 2244	2900	359D.tmp	125
PID 2244 wrote to memory of 6020	2244	361A.tmp	126
PID 6020 wrote to memory of 6036	6020	3697.tmp	127
PID 6036 wrote to memory of 5944	6036	3733.tmp	128
PID 5944 wrote to memory of 2688	5944	37CF.tmp	129
PID 2688 wrote to memory of 5228	2688	386B.tmp	130
PID 5228 wrote to memory of 4380	5228	38F8.tmp	131
PID 4380 wrote to memory of 1092	4380	39D3.tmp	132
PID 1092 wrote to memory of 1104	1092	3A8E.tmp	133
PID 1104 wrote to memory of 3172	1104	3B1B.tmp	134
PID 3172 wrote to memory of 2516	3172	3BB7.tmp	135
PID 2516 wrote to memory of 5624	2516	3C73.tmp	136
PID 5624 wrote to memory of 5904	5624	3D1F.tmp	137
PID 5904 wrote to memory of 3776	5904	3DCA.tmp	138
PID 3776 wrote to memory of 5708	3776	3E57.tmp	139
PID 5708 wrote to memory of 3100	5708	3EE4.tmp	140
PID 3100 wrote to memory of 2352	3100	3F80.tmp	141
PID 2352 wrote to memory of 5392	2352	400D.tmp	142
PID 5392 wrote to memory of 5556	5392	40A9.tmp	143
PID 5556 wrote to memory of 1088	5556	4155.tmp	144
PID 1088 wrote to memory of 2540	1088	41F1.tmp	145
PID 2540 wrote to memory of 2360	2540	428D.tmp	146
PID 2360 wrote to memory of 4716	2360	4349.tmp	147
PID 4716 wrote to memory of 2500	4716	4404.tmp	148
PID 2500 wrote to memory of 4412	2500	44B0.tmp	149
PID 4412 wrote to memory of 4508	4412	452D.tmp	150
PID 4508 wrote to memory of 5264	4508	4608.tmp	151
PID 5264 wrote to memory of 5772	5264	46C3.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ce78feea45c5799e1cbe0afca24a0ca_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ce78feea45c5799e1cbe0afca24a0ca_elex_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\16DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\16DA.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Users\Admin\AppData\Local\Temp\1803.tmp
    "C:\Users\Admin\AppData\Local\Temp\1803.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\18ED.tmp
      "C:\Users\Admin\AppData\Local\Temp\18ED.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\19C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19C8.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\1A54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A54.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\1B9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\1D23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D23.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\1DFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\1EF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\1FD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\20AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20AD.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\2178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2178.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\2244.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2244.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\231E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\231E.tmp"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\23E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23E9.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\2495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2495.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\259F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\259F.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\266A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\266A.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:272
        
        C:\Users\Admin\AppData\Local\Temp\2783.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2783.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\283F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\283F.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\2929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2929.tmp"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\29D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29D5.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\2A91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A91.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\2BAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\2CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CB3.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\2DCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\2F92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F92.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\307C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\307C.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\3167.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3167.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\3212.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3212.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\331C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\331C.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\33E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33E7.tmp"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\3474.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3474.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\3500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3500.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\359D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\359D.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\361A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\361A.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\3697.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3697.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\3733.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3733.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\37CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37CF.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\386B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\386B.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\38F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38F8.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\39D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39D3.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\3A8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\3B1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\3BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\3C73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C73.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\3D1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\3DCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\3E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E57.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\3EE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\3F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F80.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\400D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\400D.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\40A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40A9.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\4155.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4155.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\41F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41F1.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\428D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\428D.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\4349.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4349.tmp"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\4404.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4404.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\44B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44B0.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\452D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\452D.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\4608.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4608.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\46C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46C3.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\4750.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4750.tmp"
        65⤵
        Executes dropped EXE
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\480B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\480B.tmp"
        66⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\48B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48B7.tmp"
        67⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\4963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4963.tmp"
        68⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\4A2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"
        69⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\4AEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"
        70⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\4B96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B96.tmp"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\4C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C51.tmp"
        72⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\4CCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"
        73⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\4D7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"
        74⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\4E26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E26.tmp"
        75⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\4ED2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"
        76⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\4F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"
        77⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\4FEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"
        78⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\5078.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5078.tmp"
        79⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\5133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5133.tmp"
        80⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\51EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51EF.tmp"
        81⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\529B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\529B.tmp"
        82⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\5337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5337.tmp"
        83⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\53F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53F2.tmp"
        84⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\547F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\547F.tmp"
        85⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\551B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\551B.tmp"
        86⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\55C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55C7.tmp"
        87⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\5673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5673.tmp"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\572E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\572E.tmp"
        89⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\57DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57DA.tmp"
        90⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\5867.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5867.tmp"
        91⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\58F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58F4.tmp"
        92⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\5990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5990.tmp"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\5A0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"
        94⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\5AC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"
        95⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\5B65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B65.tmp"
        96⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\5BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"
        97⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\5C6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"
        98⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\5D1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"
        99⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\5DC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\5E43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E43.tmp"
        101⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\5ED0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"
        102⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\5F6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"
        103⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\5FF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"
        104⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\6095.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6095.tmp"
        105⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\6121.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6121.tmp"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\61CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61CD.tmp"
        107⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\624A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\624A.tmp"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\62E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62E6.tmp"
        109⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\6373.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6373.tmp"
        110⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\640F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\640F.tmp"
        111⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\64DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64DA.tmp"
        112⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\6577.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6577.tmp"
        113⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\6603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6603.tmp"
        114⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\6690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6690.tmp"
        115⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\675B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\675B.tmp"
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\6807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6807.tmp"
        117⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\68A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68A3.tmp"
        118⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\693F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\693F.tmp"
        119⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\69EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69EB.tmp"
        120⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\6A97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A97.tmp"
        121⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\6B24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B24.tmp"
        122⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\6BA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"
        123⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\6C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"
        124⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\6CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"
        125⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\6D66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D66.tmp"
        126⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\6E12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E12.tmp"
        127⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\6EAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\6F3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"
        129⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\6FD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"
        130⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\7064.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7064.tmp"
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\710F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\710F.tmp"
        132⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\71AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71AC.tmp"
        133⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\7248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7248.tmp"
        134⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\72C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72C5.tmp"
        135⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\7361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7361.tmp"
        136⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\73FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73FD.tmp"
        137⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\74B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B9.tmp"
        138⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\7546.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7546.tmp"
        139⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\75E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75E2.tmp"
        140⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\766E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\766E.tmp"
        141⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\771A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\771A.tmp"
        142⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\77D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77D6.tmp"
        143⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\7882.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7882.tmp"
        144⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\791E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\791E.tmp"
        145⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\799B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\799B.tmp"
        146⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\7A37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A37.tmp"
        147⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\7AD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"
        148⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\7B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B50.tmp"
        149⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\7BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"
        150⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\7C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C79.tmp"
        151⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\7CF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"
        152⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\7D93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D93.tmp"
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\7E8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"
        154⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\7F19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F19.tmp"
        155⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\7FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"
        156⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\80A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80A0.tmp"
        157⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\811D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\811D.tmp"
        158⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\81C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81C9.tmp"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\8265.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8265.tmp"
        160⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\82F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82F2.tmp"
        161⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\839D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\839D.tmp"
        162⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\841A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\841A.tmp"
        163⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\8488.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8488.tmp"
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\8514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8514.tmp"
        165⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\85A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85A1.tmp"
        166⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\862E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\862E.tmp"
        167⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\86BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86BA.tmp"
        168⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\8747.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8747.tmp"
        169⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\87E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87E3.tmp"
        170⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\8851.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8851.tmp"
        171⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\890C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\890C.tmp"
        172⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\8999.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8999.tmp"
        173⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\8A64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A64.tmp"
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\8B1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"
        175⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\8BCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"
        176⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\8C67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C67.tmp"
        177⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\8CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"
        178⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\8D71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D71.tmp"
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\8DFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"
        180⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\8E9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"
        181⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\8F27.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F27.tmp"
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\8FC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"
        183⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\905F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905F.tmp"
        184⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\910B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\910B.tmp"
        185⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\91B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91B7.tmp"
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\9272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9272.tmp"
        187⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\92FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92FF.tmp"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\938C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\938C.tmp"
        189⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\9428.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9428.tmp"
        190⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\94B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B4.tmp"
        191⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\9541.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9541.tmp"
        192⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\95BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95BE.tmp"
        193⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\964B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\964B.tmp"
        194⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\96F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96F7.tmp"
        195⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\97A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97A2.tmp"
        196⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\984E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\984E.tmp"
        197⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\9919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9919.tmp"
        198⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\99A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99A6.tmp"
        199⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\9A62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A62.tmp"
        200⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\9B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"
        201⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\9B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"
        202⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\9C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C36.tmp"
        203⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\9CC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"
        204⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\9D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D30.tmp"
        205⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\9DBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"
        206⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\9E59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E59.tmp"
        207⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\9EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"
        208⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\9F72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F72.tmp"
        209⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\A00F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A00F.tmp"
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\A09B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A09B.tmp"
        211⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\A118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A118.tmp"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\A1D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"
        213⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\A260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A260.tmp"
        214⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\A2FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"
        215⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\A399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A399.tmp"
        216⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\A426.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A426.tmp"
        217⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\A4C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"
        218⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\A56E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A56E.tmp"
        219⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\A60A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A60A.tmp"
        220⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\A6A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"
        221⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\A742.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A742.tmp"
        222⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\A7FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"
        223⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\A86B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A86B.tmp"
        224⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\A917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A917.tmp"
        225⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\A9C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"
        226⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\AA6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"
        227⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\AB0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"
        228⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\ABC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"
        229⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\AC63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC63.tmp"
        230⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\AD0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\ADAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"
        232⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\AE38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE38.tmp"
        233⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\AEC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"
        234⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\AF51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF51.tmp"
        235⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\AFDE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\B06A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B06A.tmp"
        237⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\B0F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"
        238⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\B174.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B174.tmp"
        239⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\B220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B220.tmp"
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\B29D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B29D.tmp"
        241⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\B329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B329.tmp"
        242⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\B3A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\B423.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B423.tmp"
        244⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\B4DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"
        245⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\B57B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B57B.tmp"
        246⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\B5F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"
        247⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\B685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B685.tmp"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        249⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\B7BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"
        250⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\B859.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B859.tmp"
        251⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\B8E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"
        252⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\B992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B992.tmp"
        253⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\BA1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"
        254⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\BADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BADA.tmp"
        255⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\BB76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB76.tmp"
        256⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\BC32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC32.tmp"
        257⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\BCBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"
        258⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\BD6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"
        259⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\BE07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE07.tmp"
        260⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\BEB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"
        261⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\BF4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"
        262⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\BFCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"
        263⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\C068.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C068.tmp"
        264⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\C114.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C114.tmp"
        265⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\C1A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"
        266⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\C23D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C23D.tmp"
        267⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\C2D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"
        268⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\C385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C385.tmp"
        269⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\C402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C402.tmp"
        270⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\C49E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C49E.tmp"
        271⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\C569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C569.tmp"
        272⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\C605.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C605.tmp"
        273⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\C6B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"
        274⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\C73E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C73E.tmp"
        275⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\C7CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"
        276⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\C848.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C848.tmp"
        277⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\C8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"
        278⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\C990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C990.tmp"
        279⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\CA1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"
        280⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\CA99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA99.tmp"
        281⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\CB16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB16.tmp"
        282⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\CBB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"
        283⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\CC6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"
        284⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\CD0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"
        285⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\CDB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"
        286⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\CE43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE43.tmp"
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\CEEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"
        288⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\CF8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"
        289⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\D018.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D018.tmp"
        290⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\D0B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"
        291⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\D150.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D150.tmp"
        292⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\D1CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"
        293⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\D269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D269.tmp"
        294⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\D306.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D306.tmp"
        295⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\D3C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"
        296⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\D45D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D45D.tmp"
        297⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\D4EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"
        298⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\D586.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D586.tmp"
        299⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\D603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D603.tmp"
        300⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\D671.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D671.tmp"
        301⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\D6FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"
        302⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\D799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D799.tmp"
        303⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\D826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D826.tmp"
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\D8B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"
        305⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\D930.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D930.tmp"
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\D9AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"
        307⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\DA2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"
        308⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\DAE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"
        309⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\DB72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB72.tmp"
        310⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\DC1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"
        311⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\DCCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"
        312⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\DD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD56.tmp"
        313⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\DDE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"
        314⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\DE60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE60.tmp"
        315⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\DEEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"
        316⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\DF98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF98.tmp"
        317⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\E035.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E035.tmp"
        318⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\E0F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\E18C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E18C.tmp"
        320⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\E219.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E219.tmp"
        321⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\E2A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"
        322⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\E332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E332.tmp"
        323⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\E3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\E44B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E44B.tmp"
        325⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\E4C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"
        326⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\E574.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E574.tmp"
        327⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\E601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E601.tmp"
        328⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\E6BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"
        329⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\E72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E72A.tmp"
        330⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\E797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E797.tmp"
        331⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\E833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E833.tmp"
        332⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\E8D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"
        333⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\E95C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E95C.tmp"
        334⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\E9F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"
        335⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\EAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"
        336⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\EB31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB31.tmp"
        337⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\EBED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBED.tmp"
        338⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\ECA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"
        339⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\ED25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED25.tmp"
        340⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\EDA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"
        341⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\EE4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"
        342⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\EEEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"
        343⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\EF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF77.tmp"
        344⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\F023.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F023.tmp"
        345⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\F0AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"
        346⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\F11D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F11D.tmp"
        347⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\F1B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"
        348⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\F255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F255.tmp"
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\F2E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"
        350⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\F35F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F35F.tmp"
        351⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\F3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"
        352⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\F488.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F488.tmp"
        353⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\F505.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F505.tmp"
        354⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\F5A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"
        355⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\F67C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F67C.tmp"
        356⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\F6F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"
        357⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\F785.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F785.tmp"
        358⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\F802.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F802.tmp"
        359⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\F8CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"
        360⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\F95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F95A.tmp"
        361⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\FA06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA06.tmp"
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\FA83.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA83.tmp"
        363⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\FB00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB00.tmp"
        364⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\FBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"
        365⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\FC58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC58.tmp"
        366⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\FCF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"
        367⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\FD71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD71.tmp"
        368⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\FE2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"
        369⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\FEE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"
        370⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\FFB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"
        371⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30.tmp"
        372⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC.tmp"
        373⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\169.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\169.tmp"
        374⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\1F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F5.tmp"
        375⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        376⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\2FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FF.tmp"
        377⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\38B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38B.tmp"
        378⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\408.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\408.tmp"
        379⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\495.tmp"
        380⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\522.tmp"
        381⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\5AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AE.tmp"
        382⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\63B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63B.tmp"
        383⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\6B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B8.tmp"
        384⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\754.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\754.tmp"
        385⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\810.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\810.tmp"
        386⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\88D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88D.tmp"
        387⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\929.tmp"
        388⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\9E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E4.tmp"
        389⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A90.tmp"
        390⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\B2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2D.tmp"
        391⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\BAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAA.tmp"
        392⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C36.tmp"
        393⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB3.tmp"
        394⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F.tmp"
        395⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\E1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1B.tmp"
        396⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\EA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA7.tmp"
        397⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\F34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F34.tmp"
        398⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\FC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC0.tmp"
        399⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\105D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\105D.tmp"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\1109.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1109.tmp"
        401⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\11B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11B4.tmp"
        402⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\1222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1222.tmp"
        403⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\129F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\129F.tmp"
        404⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\133B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\133B.tmp"
        405⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\13E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13E7.tmp"
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\1474.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1474.tmp"
        407⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\1500.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1500.tmp"
        408⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\157D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\157D.tmp"
        409⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\1619.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1619.tmp"
        410⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\16A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16A6.tmp"
        411⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\1723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1723.tmp"
        412⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\17A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17A0.tmp"
        413⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\183C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\183C.tmp"
        414⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\18C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C9.tmp"
        415⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\1936.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1936.tmp"
        416⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\19D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19D3.tmp"
        417⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\1A50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A50.tmp"
        418⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\1B0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"
        419⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\1BB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"
        420⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\1C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C34.tmp"
        421⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\1CE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"
        422⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\1D6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"
        423⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\1DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"
        424⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\1E76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E76.tmp"
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\1F03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F03.tmp"
        426⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\1F9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"
        427⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\203B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\203B.tmp"
        428⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\20C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20C8.tmp"
        429⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\2145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2145.tmp"
        430⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\21E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21E1.tmp"
        431⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\226E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\226E.tmp"
        432⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\231A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\231A.tmp"
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\23C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23C5.tmp"
        434⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\2471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2471.tmp"
        435⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\24DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24DF.tmp"
        436⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\256B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\256B.tmp"
        437⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\2617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2617.tmp"
        438⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\2685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2685.tmp"
        439⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\2702.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2702.tmp"
        440⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\278E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\278E.tmp"
        441⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\280B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\280B.tmp"
        442⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\28A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28A7.tmp"
        443⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\2924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2924.tmp"
        444⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\29B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29B1.tmp"
        445⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\2A6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"
        446⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\2AEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"
        447⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\2B86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B86.tmp"
        448⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\2C03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C03.tmp"
        449⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\2C80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C80.tmp"
        450⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\2D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"
        451⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\2DB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"
        452⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\2E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E35.tmp"
        453⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\2EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"
        454⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\2F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"
        455⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\2FFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FFA.tmp"
        456⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\3087.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3087.tmp"
        457⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\3114.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3114.tmp"
        458⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\31A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31A0.tmp"
        459⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\322D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\322D.tmp"
        460⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\32C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32C9.tmp"
        461⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\3365.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3365.tmp"
        462⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\33F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33F2.tmp"
        463⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\345F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\345F.tmp"
        464⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\34EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34EC.tmp"
        465⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\3579.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3579.tmp"
        466⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\35E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35E6.tmp"
        467⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\3663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3663.tmp"
        468⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\36E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36E0.tmp"
        469⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\376D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\376D.tmp"
        470⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\37EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37EA.tmp"
        471⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\3867.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3867.tmp"
        472⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\3941.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3941.tmp"
        473⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\39FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39FD.tmp"
        474⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\3A8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"
        475⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\3B55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B55.tmp"
        476⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\3BD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"
        477⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\3C9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C9D.tmp"
        478⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\3D29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D29.tmp"
        479⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\3DB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"
        480⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\3E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E33.tmp"
        481⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\3EC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EC0.tmp"
        482⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\3F3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F3D.tmp"
        483⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\3FC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"
        484⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\4046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4046.tmp"
        485⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\40E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40E3.tmp"
        486⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\417F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417F.tmp"
        487⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\41FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41FC.tmp"
        488⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\4279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4279.tmp"
        489⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\4344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4344.tmp"
        490⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\43F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43F0.tmp"
        491⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\448C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\448C.tmp"
        492⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\4557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4557.tmp"
        493⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\4622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4622.tmp"
        494⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\46DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46DE.tmp"
        495⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\476A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\476A.tmp"
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\4826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4826.tmp"
        497⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\48C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48C2.tmp"
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\493F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\493F.tmp"
        499⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\49DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49DB.tmp"
        500⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\4A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A58.tmp"
        501⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\4AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"
        502⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\4B52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B52.tmp"
        503⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\4BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"
        504⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\4C5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"
        505⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\4CE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"
        506⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\4D85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D85.tmp"
        507⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\4DF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DF2.tmp"
        508⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\4E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E6F.tmp"
        509⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\4F2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"
        510⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\4FA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"
        511⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\5025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5025.tmp"
        512⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\50C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50C1.tmp"
        513⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\514E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\514E.tmp"
        514⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\51FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51FA.tmp"
        515⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\5296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5296.tmp"
        516⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\5332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5332.tmp"
        517⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\539F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\539F.tmp"
        518⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\546B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\546B.tmp"
        519⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        520⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\55B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55B3.tmp"
        521⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\563F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\563F.tmp"
        522⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\56EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56EB.tmp"
        523⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\5778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5778.tmp"
        524⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\5824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5824.tmp"
        525⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\58B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58B0.tmp"
        526⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\593D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\593D.tmp"
        527⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\59BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59BA.tmp"
        528⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\5A47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A47.tmp"
        529⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\5AC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AC4.tmp"
        530⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\5B41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B41.tmp"
        531⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\5BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"
        532⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\5C98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C98.tmp"
        533⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\5D35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D35.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\5DE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DE0.tmp"
        535⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\5E7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"
        536⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\5F38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F38.tmp"
        537⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\5FB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FB5.tmp"
        538⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\6061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6061.tmp"
        539⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\60DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60DE.tmp"
        540⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\616B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\616B.tmp"
        541⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\6207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6207.tmp"
        542⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\6294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6294.tmp"
        543⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\6320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6320.tmp"
        544⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\63AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63AD.tmp"
        545⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\6449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6449.tmp"
        546⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\64C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C6.tmp"
        547⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\6582.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6582.tmp"
        548⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\69F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69F6.tmp"
        549⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\6A92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A92.tmp"
        550⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\6B1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B1F.tmp"
        551⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\6BAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"
        552⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\6C67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C67.tmp"
        553⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\6D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D03.tmp"
        554⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\6D71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D71.tmp"
        555⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\6DFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DFD.tmp"
        556⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\6E7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E7A.tmp"
        557⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\6EF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EF7.tmp"
        558⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\6FA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"
        559⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\7020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7020.tmp"
        560⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\70AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70AD.tmp"
        561⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\7178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7178.tmp"
        562⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\7224.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7224.tmp"
        563⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\72D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72D0.tmp"
        564⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\736C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\736C.tmp"
        565⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\73F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73F9.tmp"
        566⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\7485.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7485.tmp"
        567⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\7522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7522.tmp"
        568⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\75BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75BE.tmp"
        569⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\762B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\762B.tmp"
        570⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\76E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76E7.tmp"
        571⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\7764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7764.tmp"
        572⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\77E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E1.tmp"
        573⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\788D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\788D.tmp"
        574⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\790A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\790A.tmp"
        575⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\79B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79B5.tmp"
        576⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\7A61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A61.tmp"
        577⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\7AEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AEE.tmp"
        578⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\7B7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"
        579⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\7BF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"
        580⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\7CA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"
        581⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\7D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D30.tmp"
        582⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\7DBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"
        583⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\7E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E88.tmp"
        584⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\7EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"
        585⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\7F91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F91.tmp"
        586⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\804D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\804D.tmp"
        587⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\80F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80F9.tmp"
        588⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\8195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8195.tmp"
        589⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\8222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8222.tmp"
        590⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\82BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82BE.tmp"
        591⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\8379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8379.tmp"
        592⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\8406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8406.tmp"
        593⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\8493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8493.tmp"
        594⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\855E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\855E.tmp"
        595⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\85FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85FA.tmp"
        596⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\8696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8696.tmp"
        597⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\8723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8723.tmp"
        598⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\87CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87CF.tmp"
        599⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\886B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\886B.tmp"
        600⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\8917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8917.tmp"
        601⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\89B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89B3.tmp"
        602⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\8A5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"
        603⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\8B0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"
        604⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\8BC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"
        605⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\8C82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C82.tmp"
        606⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\8D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"
        607⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\8DDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DDA.tmp"
        608⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\8E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E95.tmp"
        609⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\8F31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F31.tmp"
        610⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\8FBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FBE.tmp"
        611⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\905A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\905A.tmp"
        612⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\9116.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9116.tmp"
        613⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\91B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91B2.tmp"
        614⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\926E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\926E.tmp"
        615⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\92EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92EB.tmp"
        616⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\9387.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9387.tmp"
        617⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\9433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9433.tmp"
        618⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\94B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B0.tmp"
        619⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\954C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\954C.tmp"
        620⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\95F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95F8.tmp"
        621⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\96A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96A4.tmp"
        622⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\975F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\975F.tmp"
        623⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\97DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97DC.tmp"
        624⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\9888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9888.tmp"
        625⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\9915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9915.tmp"
        626⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\99E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E0.tmp"
        627⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\9A8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A8C.tmp"
        628⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\9B57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B57.tmp"
        629⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\9C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C22.tmp"
        630⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\9C9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C9F.tmp"
        631⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\9D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"
        632⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\9DB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"
        633⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\9E54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E54.tmp"
        634⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\9EF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF1.tmp"
        635⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\9F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F9D.tmp"
        636⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\A029.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A029.tmp"
        637⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\A0A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"
        638⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\A152.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A152.tmp"
        639⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\A1EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1EE.tmp"
        640⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\A28B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A28B.tmp"
        641⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\A308.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A308.tmp"
        642⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\A3A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3A4.tmp"
        643⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\A46F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A46F.tmp"
        644⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\A51B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A51B.tmp"
        645⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\A5A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"
        646⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\A644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A644.tmp"
        647⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\A6D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"
        648⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\A76D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A76D.tmp"
        649⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\A7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7F9.tmp"
        650⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\A886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A886.tmp"
        651⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\A912.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A912.tmp"
        652⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\A9AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"
        653⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\AA3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"
        654⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\AAC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAC8.tmp"
        655⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\AB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB74.tmp"
        656⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\AC10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC10.tmp"
        657⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\ACAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACAC.tmp"
        658⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\AD49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD49.tmp"
        659⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\ADE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADE5.tmp"
        660⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\AE71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE71.tmp"
        661⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\AF0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"
        662⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\AFAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFAA.tmp"
        663⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\B046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B046.tmp"
        664⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\B0F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0F2.tmp"
        665⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\B17F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B17F.tmp"
        666⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\B20B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B20B.tmp"
        667⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\B298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B298.tmp"
        668⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\B344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B344.tmp"
        669⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\B40F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B40F.tmp"
        670⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\B4BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4BB.tmp"
        671⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\B5A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5A5.tmp"
        672⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\B622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B622.tmp"
        673⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\B6AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6AF.tmp"
        674⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\B75B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B75B.tmp"
        675⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\B7F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7F7.tmp"
        676⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\B8A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8A3.tmp"
        677⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\B93F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B93F.tmp"
        678⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\B9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9BC.tmp"
        679⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\BA39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA39.tmp"
        680⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\BAB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAB6.tmp"
        681⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\BB33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB33.tmp"
        682⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\BBB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBB0.tmp"
        683⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\BC2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC2D.tmp"
        684⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\BCBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"
        685⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\BD46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD46.tmp"
        686⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\BDC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"
        687⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\BE60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE60.tmp"
        688⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\BECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BECD.tmp"
        689⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\BF69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF69.tmp"
        690⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\C015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C015.tmp"
        691⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\C0D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0D1.tmp"
        692⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\C16D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C16D.tmp"
        693⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\C209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C209.tmp"
        694⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\C2A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2A5.tmp"
        695⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\C351.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C351.tmp"
        696⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\C3DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3DE.tmp"
        697⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\C499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C499.tmp"
        698⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\C536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C536.tmp"
        699⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\C5C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5C2.tmp"
        700⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\C65E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C65E.tmp"
        701⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\C6FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6FB.tmp"
        702⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\C778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C778.tmp"
        703⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\C7F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7F5.tmp"
        704⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\C891.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C891.tmp"
        705⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\C93D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C93D.tmp"
        706⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\C9D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9D9.tmp"
        707⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\CA66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA66.tmp"
        708⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\CB02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB02.tmp"
        709⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\CBAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBAE.tmp"
        710⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\CC1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC1B.tmp"
        711⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\CCB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCB7.tmp"
        712⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\CD44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD44.tmp"
        713⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\CDB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB1.tmp"
        714⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\CE6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE6D.tmp"
        715⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\CEDA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEDA.tmp"
        716⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        717⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\D022.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D022.tmp"
        718⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\D0BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0BF.tmp"
        719⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\D16B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D16B.tmp"
        720⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\D1F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1F7.tmp"
        721⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\D265.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D265.tmp"
        722⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\D2F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F1.tmp"
        723⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\D38D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D38D.tmp"
        724⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\D439.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D439.tmp"
        725⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\D4F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4F5.tmp"
        726⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\D581.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D581.tmp"
        727⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\D62D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D62D.tmp"
        728⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\D6AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6AA.tmp"
        729⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\D766.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D766.tmp"
        730⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\D812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D812.tmp"
        731⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\D89E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D89E.tmp"
        732⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\D94A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D94A.tmp"
        733⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\D9E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9E6.tmp"
        734⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\DA73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA73.tmp"
        735⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\DB1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB1F.tmp"
        736⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\DBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBAC.tmp"
        737⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\DC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC29.tmp"
        738⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\DCB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCB5.tmp"
        739⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\DD32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD32.tmp"
        740⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\DDCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDCE.tmp"
        741⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\DE8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8A.tmp"
        742⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\DF45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF45.tmp"
        743⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\E020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E020.tmp"
        744⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\E0AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0AD.tmp"
        745⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\E139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E139.tmp"
        746⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\E1C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1C6.tmp"
        747⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\E243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E243.tmp"
        748⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\E2D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"
        749⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\E36C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E36C.tmp"
        750⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\E427.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E427.tmp"
        751⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\E4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"
        752⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\E57F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E57F.tmp"
        753⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\E63B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E63B.tmp"
        754⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\E6F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6F6.tmp"
        755⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\E773.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E773.tmp"
        756⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\E800.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E800.tmp"
        757⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\E87D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E87D.tmp"
        758⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\E8FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8FA.tmp"
        759⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\E986.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E986.tmp"
        760⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\EA23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA23.tmp"
        761⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\EAAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAAF.tmp"
        762⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\EB4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB4C.tmp"
        763⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\EC07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC07.tmp"
        764⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\EC94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC94.tmp"
        765⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\ED40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED40.tmp"
        766⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\EDAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDAD.tmp"
        767⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\EE68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE68.tmp"
        768⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\EF34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF34.tmp"
        769⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\EFC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFC0.tmp"
        770⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\F03D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F03D.tmp"
        771⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\F0BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0BA.tmp"
        772⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\F137.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F137.tmp"
        773⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\F1C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1C4.tmp"
        774⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\F270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F270.tmp"
        775⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\F30C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F30C.tmp"
        776⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\F3A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3A8.tmp"
        777⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\F444.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F444.tmp"
        778⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\F4C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4C1.tmp"
        779⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\F54E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F54E.tmp"
        780⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\F5DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5DB.tmp"
        781⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\F677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F677.tmp"
        782⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\F723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F723.tmp"
        783⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\F7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7A0.tmp"
        784⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\F83C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F83C.tmp"
        785⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\F8E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8E8.tmp"
        786⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\F975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F975.tmp"
        787⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\FA20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA20.tmp"
        788⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\FA9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA9D.tmp"
        789⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\FB1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB1A.tmp"
        790⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\FBA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBA7.tmp"
        791⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\FC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC24.tmp"
        792⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\FCD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD0.tmp"
        793⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\FD4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD4D.tmp"
        794⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\FDF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDF9.tmp"
        795⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\FE76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE76.tmp"
        796⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\FF02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF02.tmp"
        797⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\FFCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFCE.tmp"
        798⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A.tmp"
        799⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\106.tmp"
        800⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\1C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C2.tmp"
        801⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\24E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24E.tmp"
        802⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\2BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC.tmp"
        803⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348.tmp"
        804⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\3F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F4.tmp"
        805⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\471.tmp"
        806⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\4FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE.tmp"
        807⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\58A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58A.tmp"
        808⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617.tmp"
        809⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\6B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3.tmp"
        810⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\721.tmp"
        811⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\79E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79E.tmp"
        812⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\81B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81B.tmp"
        813⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\8A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A7.tmp"
        814⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\972.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\972.tmp"
        815⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0F.tmp"
        816⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\A9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9B.tmp"
        817⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\B28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B28.tmp"
        818⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\BA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA5.tmp"
        819⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C22.tmp"
        820⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\CAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE.tmp"
        821⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\D3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3B.tmp"
        822⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\DE7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE7.tmp"
        823⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\E93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E93.tmp"
        824⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F10.tmp"
        825⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAC.tmp"
        826⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\1029.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1029.tmp"
        827⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\10A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10A6.tmp"
        828⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\1181.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1181.tmp"
        829⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\121D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\121D.tmp"
        830⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        831⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\1365.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1365.tmp"
        832⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\13F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13F2.tmp"
        833⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\145F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\145F.tmp"
        834⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\14EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14EC.tmp"
        835⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\1588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1588.tmp"
        836⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\1634.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1634.tmp"
        837⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\16E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16E0.tmp"
        838⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\178C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\178C.tmp"
        839⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\1838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1838.tmp"
        840⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\18E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18E3.tmp"
        841⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\1970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1970.tmp"
        842⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\19ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19ED.tmp"
        843⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\1A6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A6A.tmp"
        844⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\1B45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B45.tmp"
        845⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\1BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BF1.tmp"
        846⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\1C9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C9D.tmp"
        847⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\1D48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D48.tmp"
        848⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\1DB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DB6.tmp"
        849⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\1E52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E52.tmp"
        850⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\1EEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EEE.tmp"
        851⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\1F6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F6B.tmp"
        852⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\1FE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FE8.tmp"
        853⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\2085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2085.tmp"
        854⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\20F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20F2.tmp"
        855⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\217F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\217F.tmp"
        856⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\221B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\221B.tmp"
        857⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\22A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22A7.tmp"
        858⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\2324.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2324.tmp"
        859⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\23D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D0.tmp"
        860⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\248C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\248C.tmp"
        861⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\2518.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2518.tmp"
        862⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\2595.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2595.tmp"
        863⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\2622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2622.tmp"
        864⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\26BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26BE.tmp"
        865⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\274B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\274B.tmp"
        866⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\27C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27C8.tmp"
        867⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\2845.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2845.tmp"
        868⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\2900.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2900.tmp"
        869⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\29BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29BC.tmp"
        870⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\2A49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A49.tmp"
        871⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\2B14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B14.tmp"
        872⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\2BC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC0.tmp"
        873⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\2C4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C4C.tmp"
        874⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\2D17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D17.tmp"
        875⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\2D94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D94.tmp"
        876⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\2E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E21.tmp"
        877⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\2EAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"
        878⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\2F1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F1B.tmp"
        879⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\2FB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FB7.tmp"
        880⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\3034.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3034.tmp"
        881⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\30D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30D0.tmp"
        882⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\317C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\317C.tmp"
        883⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\31EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31EA.tmp"
        884⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\3286.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3286.tmp"
        885⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\3313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3313.tmp"
        886⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\3390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3390.tmp"
        887⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\33FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33FD.tmp"
        888⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\348A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\348A.tmp"
        889⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\3526.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3526.tmp"
        890⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\35C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35C2.tmp"
        891⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\365E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\365E.tmp"
        892⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\370A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\370A.tmp"
        893⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\37A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37A6.tmp"
        894⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\3862.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3862.tmp"
        895⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\38EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38EF.tmp"
        896⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\397B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\397B.tmp"
        897⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\39F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39F8.tmp"
        898⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\3A75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A75.tmp"
        899⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\3B11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B11.tmp"
        900⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\3BAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BAE.tmp"
        901⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\3C3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C3A.tmp"
        902⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\3CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CA8.tmp"
        903⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\3D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D25.tmp"
        904⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\3D92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D92.tmp"
        905⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\3E1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E1F.tmp"
        906⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\3EBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EBB.tmp"
        907⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        908⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\3FF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FF3.tmp"
        909⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\4061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4061.tmp"
        910⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\40DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40DE.tmp"
        911⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\418A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418A.tmp"
        912⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\4226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4226.tmp"
        913⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\42B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42B3.tmp"
        914⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\4320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4320.tmp"
        915⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\437E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\437E.tmp"
        916⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\440A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\440A.tmp"
        917⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\4478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4478.tmp"
        918⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\44F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44F5.tmp"
        919⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\4591.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4591.tmp"
        920⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\462D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\462D.tmp"
        921⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\46C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46C9.tmp"
        922⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\4775.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4775.tmp"
        923⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\47F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47F2.tmp"
        924⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\486F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\486F.tmp"
        925⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\48FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48FC.tmp"
        926⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\4989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4989.tmp"
        927⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\4A25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A25.tmp"
        928⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\4AB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AB1.tmp"
        929⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\4B1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B1F.tmp"
        930⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\4BAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BAB.tmp"
        931⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\4C38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C38.tmp"
        932⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\4CE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CE4.tmp"
        933⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\4D80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D80.tmp"
        934⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\4E2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E2C.tmp"
        935⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\4E8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E8A.tmp"
        936⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\4F07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F07.tmp"
        937⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\4F84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F84.tmp"
        938⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\5001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5001.tmp"
        939⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\507E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\507E.tmp"
        940⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\50EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50EB.tmp"
        941⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\5178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5178.tmp"
        942⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\51E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51E5.tmp"
        943⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\5291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5291.tmp"
        944⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\530E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\530E.tmp"
        945⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\53AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AA.tmp"
        946⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\5437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5437.tmp"
        947⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\54B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54B4.tmp"
        948⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\5550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5550.tmp"
        949⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\55EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55EC.tmp"
        950⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\5669.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5669.tmp"
        951⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\5706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5706.tmp"
        952⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\57A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57A2.tmp"
        953⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\582F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\582F.tmp"
        954⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\58CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58CB.tmp"
        955⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\5957.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5957.tmp"
        956⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\59F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F4.tmp"
        957⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\5A80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A80.tmp"
        958⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\5B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B0D.tmp"
        959⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\5BA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BA9.tmp"
        960⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\5C36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C36.tmp"
        961⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\5CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CB3.tmp"
        962⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\5D20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D20.tmp"
        963⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\5DAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DAD.tmp"
        964⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\5E49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E49.tmp"
        965⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\5ED6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ED6.tmp"
        966⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\5F62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F62.tmp"
        967⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\600E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\600E.tmp"
        968⤵
        
        PID:8080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\16DA.tmp
Size 520KB
SHA256 84a2ef84b804c53d2adcc602959889cf6e29c9080b4496a01366db4bccebea31
MD5 0dd78a4197a3df9c354b2c3b92563527
SHA1 dd2ad19463fa145de46cef89d2efa0748b0d1772
SHA512 8f7f2551005c70073364a4b3d2e42361bf9cbc8ae69c7311b7f7d3c1af76fec0fc4f58eedff3bc011d7b78244b4241be9d433338ebe6f65f0b8e088d613a72ab
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL8PSL0YqSJn+z7uF4GAdCCDEkdr5j1Ib9AEQpG:roRXOQjmOyMPSZJn+I4GAQIrQ5AE6NZE
TLSH
T1B1B4F0227489C032F5A616354B26DBA54B3F7D63972A62C73BC4366D6FB02C1EA74307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1803.tmp

Path C:\Users\Admin\AppData\Local\Temp\1803.tmp
Size 520KB
SHA256 4104de2db2690fe8c811d83d9cdbe6088900469546a7ae4c32fc1c56e91cbae1
MD5 e4bdb412cd3ae921232e84696110b3ac
SHA1 44e0a6fb434fd94cc9dd2e7de2ef10310dbb5f81
SHA512 bcff548a2332413a0fcc723c47b34dfe51f317fe8cd0d263963d48724c03ee49eee7f03f0a71859d5d1926fc71a2f9e8e884dad98d52965c517615cf80216c86
SSDEEP 12288:roRXOQjmOymC6g0jPBh2Xtnos6VY49NZE:rogQ9yD0bBkdbmNN6
TLSH
T14CB4E0237588C036E58226358B26DFA14A3E7D375B2952C73B843A6D7EB42C1E7B4347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\18ED.tmp
Size 520KB
SHA256 2c10c3b70a27ed8adb4b270c5a139401fa90dbcbb984094cd1ccd66be3b6e606
MD5 79b2ee1fc41c57746b8db6de708ed31a
SHA1 a2247d889b604c5eb1233b0fb759b047a7ae8e1e
SHA512 f2855af8e468e74f55929b44987f84ec683a087f07820195c9f53e32c555c3d1457d07a5ca5a97446e71a14c8912a2e5d3b209a6ad6f82c84df8dec976572a58
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL0uctwDz3j+y9MghwLBkOjU+noZPAWleYQSB1r:roRXOQjmOyE7Kvj+Apw95lnWjBIUYNZE
TLSH
T10BB4F0227584C036E5D216304B26DFB20B3E7D369B2562C73BD42A6DAEB42C2E775347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\19C8.tmp
Size 520KB
SHA256 12647af4a58803a4584fc74c3db2fe11b68586168a0f74c3f450a0e80d60fe32
MD5 b7ffc129a9b6ae9b007500154680e652
SHA1 a500c647438306e31748a919c1d937a940e9879b
SHA512 61dcb6a4c73e50586d56f4a967bf7576ac5bacfc6455275147587c2ca1e719ebe49b0061330edb4531bbb8519ff11d7f1d4f0e5d72daa0e70ee07f7d7ff406a7
SSDEEP 12288:roRXOQjmOy7rKdZHDKnxxwlrH4+2dDqM34ENZE:rogQ9yXsHDKxx6rHULHN6
TLSH
T18CB4F1227584C032E1D262319B26DFA14B3F7C66572662C73B843A6D6FF42D1E778386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A54.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A54.tmp
Size 520KB
SHA256 bd42276ef2c6e90a620601a24e7cb680f3cce98ff9202b495bd0034fbc524df9
MD5 14f9a06a7f936370f7bfc6dd9fcc9194
SHA1 54c705584a57d81e344ec44962d232f621b27a2d
SHA512 0e387d9ec0e2b569d0d860a92a6006e30424e8149f78ee69a2016b9bd60c8e2a61558bd9e29acaa4562311e18e3a37620d1fc1e3d3a0daf4e8c1654caedd78ce
SSDEEP 12288:roRXOQjmOyhyqGZnRNlxvwOyLr+90h/NZE:rogQ9ytG5lJw7uQN6
TLSH
T153B4F0227589C036E49611344B26DFA15B7E7D728B2A92C73BC8367C6FB42C1E6B4343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\1B9C.tmp
Size 520KB
SHA256 c6202168fee3c22e320fceff142678378cf24a68c6f35c34f42f9f49b02d137b
MD5 ba7be61ae32e806a05efc7ab3a0a3186
SHA1 de2e883f7085011de5af40353950b22f0bdb222d
SHA512 366944aa3423bf2c3599c965651c764e5c7d32fe124b222e5a71c957704120a516a39d6d9899cf45d66227ea00fb48ba7646c8357d644f729e2ef0ad84ed3c33
SSDEEP 12288:roRXOQjmOyGJ5cIZSzFN1iFd5CI+pyaemtPNZE:rogQ9yTuSzZF/p1emxN6
TLSH
T108B4F0127188C036E59252348B62DFA15A3E7D768B3952C73B843A6DAFF42D0E774387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D23.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D23.tmp
Size 520KB
SHA256 2494d16e6217df3704acd26af3ab4bfc5de734a906006d2cd0bc3b21cd2fc8ac
MD5 1d4d83026b0880eaad451dc088199135
SHA1 1da343e11f526ef479529da870c0e53da2b80e43
SHA512 baf7efe0c2b4e1ab4b2496bdb678c8d7583737d495f41c65c48f204ec1e1fb18821b9b0cfd314de2e89e19ba9b2c70b55b14993d215e9f4fee3508713911db2d
SSDEEP 12288:roRXOQjmOyeuG+GlY2DdhERrE1ruvO1RTC2UNZE:rogQ9yelJpMo1ruqTCNN6
TLSH
T1FAB4F0167589C036E5D251304B26DF614B3EBD725B2A52C72B803A7D2EF56C2EBB8343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1DFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\1DFE.tmp
Size 520KB
SHA256 a5b34444c6edfa516262dd3ac39ce9a6ef6e7e894b6b4c49c7d8d7fbcffb8c24
MD5 df37c57997e1b75874740941db231646
SHA1 ba90a3f2df221428b38a3e94443cbb70e80bf39e
SHA512 43b34c46cd9b7f2736ee032b9aabe476347bffca79d2746ad6c1104d58c54ddb0bf9cb72ac0656d1ed65456ede4ff4de62027485c3867df9720b125a395703fa
SSDEEP 12288:roRXOQjmOyMn081frG2+ZbPi3SZ42JeLzUCTBLpNZE:rogQ9yMnti/JeLgeBLpN6
TLSH
T110B4F1127188C036E58215354F66DF621B3E7C625B2AA2C73B843A6D7FB42D1E7B9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1EF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EF8.tmp
Size 520KB
SHA256 ed8e599fd3612a02f84eb1513a2aaebc946e7455c37960165f138e056ddbbcdb
MD5 bc952b61bd04ec6a4e484b13881bee1e
SHA1 f8b26942f1041ea0febc5345b03bed91a24dbee6
SHA512 7fe482796bf72052090b246952f7956697cb9bd332b455893e4c64bdd8437714b19e9ced31741bdb362ce3656ed03659178ef376f4b12bfe2602d40837a08397
SSDEEP 12288:roRXOQjmOyQe9x55WjqVa9djg+70wA611NZE:rogQ9yQe9jVcdjUMN6
TLSH
T1B0B4F1227588C036E5D215304B26DFA15A3E3D769B3A52C73B842A6E6FF03C1E675387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1FD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\1FD3.tmp
Size 520KB
SHA256 ed3a13e9acbbb85fc415af1066fa7b10b3b19553a61268bc50418c2026a91eef
MD5 a21387a2c28a1258237066b1e5e4149f
SHA1 00a2aaad033d13d8996bd0d13827751034ae7dbe
SHA512 a925764600471b4d7c214598f5384be2ade355e70cd6d2b420aace1ddd4b846de84e9a3f0b1806b47d77ef89975f223e9717705a01adb1ddf3cc658e668357b9
SSDEEP 12288:roRXOQjmOyFqkbfi1hC2OUv06ypeBdGNZE:rogQ9yFq8OHOUOeBdGN6
TLSH
T1C3B4F022B144C032E59212344B26DFA14A7E7D766B2A56C73BD43A6D7FB42C1E3B8347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\20AD.tmp
Size 520KB
SHA256 6e0c30cb0fe6837a2c1da15d3154289ff14ce6f37860c003430222baf59dd5cf
MD5 1a8aefee483fb6ff1a55386b06511dd2
SHA1 ac11327208a198f77cb5bccad4522b6a3dc2f370
SHA512 e502d06aa70dd8c8311f65e4cf441c72db1ed39225f12c2cf1f2a3aa58b1ae71342758fb7cec3926aab5d7bf6c16645600a16381c82de17fe8ed8d934eb9b8d9
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLizLlAsIWVVsjKacMWssrejMXRfLKTfHqQNYVw:roRXOQjmOyeDVc9W1jR6TNYgANZE
TLSH
T1F6B4F122B589C032E89615304B26CFA14B3A7D775B2A52C777843AAD7FB42C1EB74347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2178.tmp

Path C:\Users\Admin\AppData\Local\Temp\2178.tmp
Size 520KB
SHA256 e4ef5f0704d9a91376f3df9bc42b6ea625628f561b9bd69f2e89c0eda07326be
MD5 2d83d339153ab433db8d50e6974b0033
SHA1 4cfe012ba1dac6d75fc63a902198e8e2608f5cf6
SHA512 98f22e7cdf2cce2e4500feb48fb41b595cd455606df5ee704567fd532a9a4124b2ee1ae91271ce8482877852b4778218d8e9698416bff482ebbf1239fa7764b6
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL+e9qWtBZhnF5HCtC1M4qVRtINh92lg2s8jWIJ:roRXOQjmOyLZXlib4Ok0hdNv/CNZE
TLSH
T138B4F1127584C032E58312308B66DFA24B3FBD73976666C72B8436696EF42D1EB74387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2244.tmp

Path C:\Users\Admin\AppData\Local\Temp\2244.tmp
Size 520KB
SHA256 a642f8153fff6e07a30af034e4eb2e1b3d644fda9fb380b43cb0bab717ba2608
MD5 b1c139e2d2051b11defd2cef453b33f1
SHA1 76bdfdcd9c228dddfd4576e169a54b4b0970d6aa
SHA512 59760573b881fa13b3a8d2417b4e7042be2d66b885446b0306b818a349e7a2b92cf7478ad5f2951b3e9d777bbd9d9928f67acfe84376bda3cc0dd43015ebb7de
SSDEEP 12288:roRXOQjmOyKgP7Zd8wTbIGtZacL5d+p57cNZE:rogQ9yKgPV9AJY5o57cN6
TLSH
T136B4F022B184C032E59215304B2ADF72577EBD779B2A92CB3784366C6FB42D2D67434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

231E.tmp

Path C:\Users\Admin\AppData\Local\Temp\231E.tmp
Size 520KB
SHA256 a18422f68f669625af7bcb68a8f4769770c2b9f4cd7f765139615eb34373a8c8
MD5 e2c441248ca68c9356daf2b58f474341
SHA1 c1ab2888f02002d8635c0b701e76be54e935cd5a
SHA512 aaa135f29528f67e155d90ce1f150a0c12fffa168637a4d1f6b0f227c02025b17e7db73824068afd6359fba67267de9a0002690726d685de760e7819b8fb0d2e
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLv8Zoca0jUwakJq13bX+zciH18l+O9Y1+FgDLJ:roRXOQjmOy/S9qaA1L+wm15OGsKwNZE
TLSH
T15BB4F0127488C032E69222354B2ADFA24A7F7D365B3956C737C43A6D6EB42C1E778347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\23E9.tmp
Size 520KB
SHA256 ade6e96ad7c2c1841ef0706624df8ebb62acb8c3c938658db14834053aef625f
MD5 25e49eecbe6ac5b95838d7d7220cdeb7
SHA1 48bac5146f7e2435217a056e0c5c94a4b983e80b
SHA512 6b26fd2d506e62f5c451994ed32a66e16f4d6356d6b5038081485ff65cbcac77195f8088bd1d05d2541cd0f6df72e8f69578c65523b1654ed9f142bf9a02e641
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLZDPK61osAryY0Kjz+3aFi5oxnvkVNJoAsH3d6:roRXOQjmOyp7d1AOY0KjSa71sb4NZE
TLSH
T155B4F0127184C032E59226314F26EBA21B3E7E674B2696C73B943A6D7FF42C1D678347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2495.tmp

Path C:\Users\Admin\AppData\Local\Temp\2495.tmp
Size 520KB
SHA256 c5048fbfcd9706d1ed05f4aaaeaba296267b2d275afb98063dfc14d1bcae78e7
MD5 56bab28b6de080b94d8b18acf8f53144
SHA1 ff18f0353ad4967c9f1285b49b709ac49f147338
SHA512 1545379cd3733b70aaa0c2a55ecaf8ec02c41a32c31f3faacdd2928d3eff9b85526ffa108ec38743663ff2aeacb9e97083f1f63bbdc2351116005d58b6148686
SSDEEP 12288:roRXOQjmOyg7VD2I10Fmpy2s4eEhHGAEcpc/Dx/NZE:rogQ9yy92Igmpyv4vhHGAEcpc/ZN6
TLSH
T145B4F1227588C032E48615318B26DFA25B3E7D739B2952C73B843A6D6FB03D1D779386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

259F.tmp

Path C:\Users\Admin\AppData\Local\Temp\259F.tmp
Size 520KB
SHA256 a3fa06f7e2c6bbbbf13a351f3513787bdea62c0e70df8ad2f3d6546878421d76
MD5 d5e2233ebfd5cb9f713080ce339128c2
SHA1 e5102edf99ef0ba4bc62d951b222af49f8b62865
SHA512 5649d651a66f2d33c827fb6ed8db7f93efdb0b6e0dc9f53bb4bc99ccb59bcb91366c5160ff2cecbe8f4e190e392b403ef374f9715d8d9565d48e2ed8c702a7fe
SSDEEP 12288:roRXOQjmOyVmxoGYeKcF3QvMse3f8SZ9voNZE:rogQ9yjGYetQ0sWf/XwN6
TLSH
T15AB4F1227184C032E5D221308B26DFA15B7A7D76872A86C73B84366D6FF42D1E779347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

266A.tmp

Path C:\Users\Admin\AppData\Local\Temp\266A.tmp
Size 520KB
SHA256 812515b622d8eb224190d1c9d2a5da5f81faa381999299f0bfcd282c662d3112
MD5 e0f276e669a45337c39e54f55d9dacac
SHA1 a5f1c10fc8ec98d28ba9660714f1cd90409c04e7
SHA512 3e9cbb679a799f1908294d87dd073e4f17c8e0724363e685b82871b8ffb11f5a2f739402cf6f30e2b43f88d12b986037d142cb83357ddcce9f0325b94fc63a7d
SSDEEP 12288:roRXOQjmOyAkvU7meaMXMfmH0EfoqptiwyfcJlwH0HzINZE:rogQ9yAkmmFhmUrqpQ7UTIN6
TLSH
T163B4E0227589C036E59311345F26CFA14B7E7D725B3A86C73B8426A96FB42C1E7B8343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2783.tmp

Path C:\Users\Admin\AppData\Local\Temp\2783.tmp
Size 520KB
SHA256 596eb4b3cf2e91fe450cdd74c52b2df9b1118ffb3f3307d8802f4fc705c0d8af
MD5 bd832613d97941bf7bccf515eda8d296
SHA1 075c881b252e6b66a3c99262fec649a053d60f16
SHA512 3e760d61f6cd60660d2309a0fe5f3c5a7de3682cb030bd43f2caa1cb04b046e85b1ef20d0116f4d433e0f168fe80006d7fae77cbbc1472253d5bc41d567d4725
SSDEEP 12288:roRXOQjmOyu6G8rPpRmhTQ4ZrX24ANRF5YHNZE:rogQ9yHXrBRm1Q6rXMNkN6
TLSH
T1C4B4F1227189C036E59226314B25CFA24A3E7D774B3A92C73B803A6D6FB52D1E774347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

283F.tmp

Path C:\Users\Admin\AppData\Local\Temp\283F.tmp
Size 520KB
SHA256 c735e4c3fd15cbf297dfc2d3be804be9504f20b2647ac7c1372ed086bf7af5ee
MD5 56267906e91c36d4d5874415ed7eec32
SHA1 63f922b8908c9451cdeaf8a7fd879f3517f60209
SHA512 f3808d4873313b7774feeec588724542e62bae49df6142f4f2403b33f15b4d9b4a344cd79dc20e4174a6ad3b530319dcd02504b90670f67efc1c214d3ac86d90
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLkGNy9fL1FnQiyC7H41Ws1l0gSYwCTwBExF0sw:roRXOQjmOyFy9f7QiFQ1DbSMMiFdNZE
TLSH
T197B4F012B588C036E5A226305B26DBA14A7E7D335B2A57C73B80266D2FF42C1E775387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2929.tmp

Path C:\Users\Admin\AppData\Local\Temp\2929.tmp
Size 520KB
SHA256 ce3d39c3f3e5da159a1b86cebe65190c3dfed59d1f43800386d2c48154621259
MD5 77576916ecc637def8da138ce47a54d4
SHA1 94fd2c58aaee952c102f74969b72a8a927846057
SHA512 589da80145ff50b48e5e1789bcfacad660136eaf9c29aecae5d2672a5551bb46c9d7cb49b4a0a5b11d8acdc249cd68459a4c5c263c331a5d9bfa4606b6c2824c
SSDEEP 12288:roRXOQjmOydxWGD32Dlz1s9M+38jag8NZE:rogQ9ydRv98jabN6
TLSH
T1FDB4F0123684C032E5D625309F2ADB611B3E7D72976A92C73BC53A6D6EF02C1E675383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\29D5.tmp
Size 520KB
SHA256 37928454ae6f7a76b3e253d2124828c07385876c7513bb04c75d3507ee8c99fd
MD5 dd04c4d25eafb5a348b1826ba260e214
SHA1 d542b1fb3d38872bad0a6e1cbd7e540740a3bfac
SHA512 0400a183edfcd743c0b2fec1e068f4add28c2152e11dcf88cff6096f6a5242ac22839f4ef55047eca4798b9c5eb39abc7dff33d392e03269086943801f1d3b46
SSDEEP 12288:roRXOQjmOyqe+yRYTCj2/i6+PhPdtRCVwIqS9SrRkNZE:rogQ9yb+sYTw9hdt8x1vN6
TLSH
T1FFB4F112B189C036E59212344B26DFA14B3E3D7B5B3682C73BC43A6D6EB42D1E675387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2A91.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A91.tmp
Size 520KB
SHA256 839afb3714727a875ae2b8fa4acdfb834bbccbbd746f7427d1b5436e29f6a191
MD5 415ef5d659945ce1537bf900b5afa0da
SHA1 6bf1682228336f16e6d5964597a1c628a7085aa2
SHA512 3f726e623245b8250e1781dcad0230d2dc7905777898feac1b13d33396d2c10d47835be5a3838c696ee96f8fe9c1049d45d2a7cc0a50a833c0ba2e416c0eb423
SSDEEP 12288:roRXOQjmOy/lgss21npcefAJ0p0fQZNZE:rogQ9y/2kpce6sLZN6
TLSH
T149B4F122B588C036E58215318B26DFA24A7E7D375B2A56C727C436BC6EF42C1E774387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2BAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\2BAA.tmp
Size 520KB
SHA256 7e2eb52ad52ce20c9b730bf933358fd15bfcd56262a542521774a4a9aa64ad4d
MD5 f5f228d76917c1e0a38e65961df71090
SHA1 e2f9a7eb71c98e2978f114a2db445f1a211a4ff3
SHA512 0efdf042e6df2936f96d626ad6b9ff10d50454f48b7562a1737ce7cd4ab2d8ae75d3cd4f1e2cc2ae9570eb04e2762ee6e8bc410e7a6e5dfeeb9f1cc439be7288
SSDEEP 12288:roRXOQjmOyt4i3Z52DBB7a1RMX3G70f7NZE:rogQ9yayZ5wTa1KX3G70f7N6
TLSH
T106B4E0227688C036F5D611308B22DF610B7B7D765B2A56C73B843A6E2FB42D2E674347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2CB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2CB3.tmp
Size 520KB
SHA256 36ebdab8fc969dff87115b7858bffd6fadb1bed3f422908ed556d191792feabb
MD5 dad559f9ae2bfcebff4f24443cf5bb0d
SHA1 8ec9115443cb110572baf9db1a067df27901df55
SHA512 197c872f5653bb95cba497e8eda9ddeb3a591a5199cbf92b64118a3711885693a30217010f6f8e18bfeb51a3ed4c7104e0ffff67642ee4a1cd1c9a6eb7a73ed1
SSDEEP 12288:roRXOQjmOyqC3CdspnHAxHIIc2moZP0uNZE:rogQ9ydCWNAiupZsuN6
TLSH
T11CB4E0227584C032E99211354B26EFB10B7E7E665B3A82C73788366D6EF42D1D774387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2DCD.tmp

Path C:\Users\Admin\AppData\Local\Temp\2DCD.tmp
Size 520KB
SHA256 017d19899564bf942e555eeabc67707d4e5a80e08c141bbc5e10ec9fa771e0f0
MD5 83d7b6c9b632aa8f4591183f65b3f7fc
SHA1 e08ab4b9f7219459826ce20859b692b748369327
SHA512 35acf0ca32c025a1363de8b7d3fe59ac298d49a5a5c3ce74a10b735f47f6bfece709b3314491ea7694c8cb4518e509a54450150e963b8ebd7b0b589d6cca7c15
SSDEEP 12288:roRXOQjmOy41o8zPaKuZ3jVdHwkS1c9HeCNZE:rogQ9y6aVdHUIeCN6
TLSH
T117B4F0127089C033E19661359B26DFA15B7A7D729B2652CB3BC03A6C6FB12C2E775343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2EB7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
Size 520KB
SHA256 907f03febd201f9680b07dfdf2818f22dacaf794e577178a0ab8f5b3b19ed945
MD5 1b92df913ad06c18066656036b09c10b
SHA1 baa476d13218f1c691953dbca3d2612c204eba83
SHA512 ff226fd761eb17ab65d11b4c9d5da95cc76f57338984d52f48b094bac22fc5f0d46f7fe0979a4bbae235e9fbd46f1efd4c1cddf77dc82165e78aa657f5bf1e2a
SSDEEP 12288:roRXOQjmOyXv1Y0pqBSpPKUKbcbvYVrNZE:rogQ9yfy/BSxEEv4N6
TLSH
T18AB4F1127188C036E59225308B26DFA2173E7D765B3A42C73B943A6D7EF42D2E774386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2F92.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F92.tmp
Size 520KB
SHA256 6b9cf4673b9be6d36658887ee2885a26d8c6e4d6cb84229dc59ae2df5ebd9d19
MD5 4a73871d40d5d5fcd3854beb1e4ba8c0
SHA1 758652a980d30db187094299d3f8f95c29d8b28a
SHA512 5e94e8d5182d19b0a14a53570057d03cc0edfe7add4087b9e16e3b2c6ec764ef3aab63fe3c1fd7363f6f2909f2e4ff8ddbf9aaef19eb93924187a5a088923f22
SSDEEP 12288:roRXOQjmOyHJSwlzo/FVwp4psKsrFfFQ2sUgvRunHdNZE:rogQ9ypSf/0eefFQQ0un9N6
TLSH
T1FFB4F122B184C032E5D216305B26CF615B7E7D729B2A92C73B843B6E6FB42C1E675347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

307C.tmp

Path C:\Users\Admin\AppData\Local\Temp\307C.tmp
Size 520KB
SHA256 f9d27671ba996a8d9fe5dea39e2f0e4b035ea4820ca45a1900e3bb101d639a4e
MD5 8d7d746fb46d06b3dd5ea07d053cc10b
SHA1 045dfc7482406688c934439b2260bf5d1545e649
SHA512 c483302a3637b545d9a8717c1754f204b52159033b1f8a3e22b7ca2ae773a092fce647c655a99cf49765057308e2a04a0c6765cb73dbdf22a0bc180bd5c453a6
SSDEEP 12288:roRXOQjmOy1IQOxAeWPGMnnKo53pMh1hP66XNZE:rogQ9yBOxjXmKo5uh184N6
TLSH
T125B4E122B188C036E59226314B15DFA15B3F3C769B2A66C73B843A796FF42C1D279347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3167.tmp

Path C:\Users\Admin\AppData\Local\Temp\3167.tmp
Size 520KB
SHA256 821783aaf869f2a431eadba35dcfc70d470a42ac19217612dff85f9d4c124713
MD5 07ad00ea974a8f0810802b50184b617e
SHA1 643799ecd32bae2f63a8da7c2bd56a5e61e8f5fd
SHA512 13915b48bbd77a4e0c19b41b20312c52732a2fcb6a07bc6ad32cdf982a495c9df458202708bc8bf98b65a9e5e4be4afd727a0eef87ae3935105feecacd1d710b
SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLqMEbXpGMiqBJrUF8z5I1QYMsowHSk53iLIITj:roRXOQjmOyyXZh2EIosown1iL37IpNZE
TLSH
T12EB4F1227189C036E49215349B66DFB10B3A7E625B2A62C73BC4372D6FB42D1E778347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3212.tmp

Path C:\Users\Admin\AppData\Local\Temp\3212.tmp
Size 520KB
SHA256 6339f5b4cc631a61165dc23a808f32805b44e02db86eed3839d86f1980d81028
MD5 42db2dccbf2575d92b4a2ce3921ce6ea
SHA1 b6a6495d65dcaa82cdbb529c624f0c7017105f21
SHA512 cb1b3558787b58aaa14a95b5f8d807352b27b0abf1c378c3e5a54bf31fe8eba27d05048a901411b13eb5dedaff1d4ecdaca7f5affdec13ede7d6ccdfdee28074
SSDEEP 12288:roRXOQjmOyukWz5XZlI1K5SO88vTVs2YC554qNZE:rogQ9y/WdplIa8qVs2Ye5N6
TLSH
T137B4F1227484C032E5D625358F26DFA24B3E7D7A872662C73B843A6D6FB42C0E674347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

331C.tmp

Path C:\Users\Admin\AppData\Local\Temp\331C.tmp
Size 520KB
SHA256 3ee7721da980e9067a803a34f033b9330fce5bef198f0c16bda51a343c8229e0
MD5 c82846d8487eb488f15fa92038140755
SHA1 23cdb6d2674703eed2f5c306103906bb5be074ba
SHA512 fd0b6b1948089f1ab6c348f95c9535831148433d9ab18d93cb2b61a16fe42c0a25835ad45333e0859f28247c2a96af971b7d7907bc7fcdab975e52cf2b4d6ae6
SSDEEP 12288:roRXOQjmOyjg9PIw5m48g8jwexpAdKBNZE:rogQ9yjg9M4yj7xpAdoN6
TLSH
T154B4F0127548C036E69625344B66CF621B7E7C729B2A52C73B843A6D7EF82C1D7B8343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads