226d70b99a7f04ada64975233984698805ceb7a3ed8c9149b0b8e97478940d16

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_28af0169b8c5dd0e0090a5a10969a3d9_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260816-sd6f1a1vbs
SHA256 226d70b99a7f04ada64975233984698805ceb7a3ed8c9149b0b8e97478940d16
MD5 28af0169b8c5dd0e0090a5a10969a3d9
SHA1 1039d72d1d78ad4da9b663610d923010f463035a
SHA512 eb0cf112fd5c810bc13f4a89d75b5924c3c19c926016261e03af3de22dc123e5c52c2d150c2aed73cafbdaac4b9e49aff4a1d48ff56b4087057f3fef7c30aaa8
SSDEEP 49152:w/OJDyox6QocNGEADt7i+/yTukuFGNLrkBirx:EOcQFchrSiGdkBirx
TLSH
T17806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4760	FB34.tmp
5740	FC0E.tmp
1548	F0.tmp
4144	3EE.tmp
6096	65F.tmp
2900	9AB.tmp
4232	C1C.tmp
2820	EDB.tmp
5544	116B.tmp
5108	14D6.tmp
2536	1776.tmp
4820	1A16.tmp
2564	1C87.tmp
5356	2001.tmp
5384	2169.tmp
5892	2541.tmp
2264	27D1.tmp
348	2A62.tmp
2412	2CE2.tmp
5912	2FA1.tmp
1384	32FD.tmp
5668	35BC.tmp
3452	37DF.tmp
2196	3975.tmp
5872	3D1F.tmp
4768	3FAF.tmp
3752	41B2.tmp
1852	4462.tmp
5752	4740.tmp
1300	49FF.tmp
2436	4D2C.tmp
2244	4F6E.tmp
4912	5143.tmp
564	523D.tmp
3904	52E9.tmp
3972	5402.tmp
3048	54DD.tmp
3924	55B7.tmp
2940	5700.tmp
1476	5809.tmp
2088	58E4.tmp
4292	599F.tmp
3012	5A7A.tmp
3656	5B93.tmp
3692	5C7E.tmp
4800	5DC6.tmp
3324	5F2D.tmp
2852	60C4.tmp
5268	61DD.tmp
1876	62A8.tmp
4328	6363.tmp
1988	642F.tmp
2044	6529.tmp
2784	6671.tmp
768	675B.tmp
1620	6807.tmp
4704	68E2.tmp
1568	69BC.tmp
4724	6A97.tmp
4668	6B82.tmp
4572	6C3D.tmp
4948	6D18.tmp
4408	6E31.tmp
1968	6EFC.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9AB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9272.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B9A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	522.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4622.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83C8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9BA5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	116B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5402.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AB79.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B02C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAB4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EE97.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DFE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A2DD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4C9B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B131.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A0F4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A26B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BB2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F2D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C411.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC30.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	569D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	951D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB6F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2FA1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69BC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39AF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B50.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEB2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EAE3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30A2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AF61.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B888.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2397.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FD0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3857.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1058.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B29D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C93D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3DE5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93C5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4D6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1C4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD27.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EE5E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A7C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58EF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89B8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A08C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8629.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B065.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A520.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4760	2868	2026-08-16_28af0169b8c5dd0e0090a5a10969a3d9_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 4760 wrote to memory of 5740	4760	FB34.tmp	90
PID 5740 wrote to memory of 1548	5740	FC0E.tmp	91
PID 1548 wrote to memory of 4144	1548	F0.tmp	92
PID 4144 wrote to memory of 6096	4144	3EE.tmp	93
PID 6096 wrote to memory of 2900	6096	65F.tmp	94
PID 2900 wrote to memory of 4232	2900	9AB.tmp	95
PID 4232 wrote to memory of 2820	4232	C1C.tmp	96
PID 2820 wrote to memory of 5544	2820	EDB.tmp	97
PID 5544 wrote to memory of 5108	5544	116B.tmp	98
PID 5108 wrote to memory of 2536	5108	14D6.tmp	99
PID 2536 wrote to memory of 4820	2536	1776.tmp	100
PID 4820 wrote to memory of 2564	4820	1A16.tmp	101
PID 2564 wrote to memory of 5356	2564	1C87.tmp	102
PID 5356 wrote to memory of 5384	5356	2001.tmp	103
PID 5384 wrote to memory of 5892	5384	2169.tmp	104
PID 5892 wrote to memory of 2264	5892	2541.tmp	105
PID 2264 wrote to memory of 348	2264	27D1.tmp	106
PID 348 wrote to memory of 2412	348	2A62.tmp	107
PID 2412 wrote to memory of 5912	2412	2CE2.tmp	108
PID 5912 wrote to memory of 1384	5912	2FA1.tmp	109
PID 1384 wrote to memory of 5668	1384	32FD.tmp	110
PID 5668 wrote to memory of 3452	5668	35BC.tmp	111
PID 3452 wrote to memory of 2196	3452	37DF.tmp	112
PID 2196 wrote to memory of 5872	2196	3975.tmp	113
PID 5872 wrote to memory of 4768	5872	3D1F.tmp	114
PID 4768 wrote to memory of 3752	4768	3FAF.tmp	115
PID 3752 wrote to memory of 1852	3752	41B2.tmp	116
PID 1852 wrote to memory of 5752	1852	4462.tmp	117
PID 5752 wrote to memory of 1300	5752	4740.tmp	118
PID 1300 wrote to memory of 2436	1300	49FF.tmp	119
PID 2436 wrote to memory of 2244	2436	4D2C.tmp	120
PID 2244 wrote to memory of 4912	2244	4F6E.tmp	121
PID 4912 wrote to memory of 564	4912	5143.tmp	122
PID 564 wrote to memory of 3904	564	523D.tmp	123
PID 3904 wrote to memory of 3972	3904	52E9.tmp	124
PID 3972 wrote to memory of 3048	3972	5402.tmp	125
PID 3048 wrote to memory of 3924	3048	54DD.tmp	126
PID 3924 wrote to memory of 2940	3924	55B7.tmp	127
PID 2940 wrote to memory of 1476	2940	5700.tmp	128
PID 1476 wrote to memory of 2088	1476	5809.tmp	129
PID 2088 wrote to memory of 4292	2088	58E4.tmp	130
PID 4292 wrote to memory of 3012	4292	599F.tmp	131
PID 3012 wrote to memory of 3656	3012	5A7A.tmp	132
PID 3656 wrote to memory of 3692	3656	5B93.tmp	133
PID 3692 wrote to memory of 4800	3692	5C7E.tmp	134
PID 4800 wrote to memory of 3324	4800	5DC6.tmp	135
PID 3324 wrote to memory of 2852	3324	5F2D.tmp	136
PID 2852 wrote to memory of 5268	2852	60C4.tmp	137
PID 5268 wrote to memory of 1876	5268	61DD.tmp	138
PID 1876 wrote to memory of 4328	1876	62A8.tmp	139
PID 4328 wrote to memory of 1988	4328	6363.tmp	140
PID 1988 wrote to memory of 2044	1988	642F.tmp	141
PID 2044 wrote to memory of 2784	2044	6529.tmp	142
PID 2784 wrote to memory of 768	2784	6671.tmp	143
PID 768 wrote to memory of 1620	768	675B.tmp	144
PID 1620 wrote to memory of 4704	1620	6807.tmp	145
PID 4704 wrote to memory of 1568	4704	68E2.tmp	146
PID 1568 wrote to memory of 4724	1568	69BC.tmp	147
PID 4724 wrote to memory of 4668	4724	6A97.tmp	148
PID 4668 wrote to memory of 4572	4668	6B82.tmp	149
PID 4572 wrote to memory of 4948	4572	6C3D.tmp	150
PID 4948 wrote to memory of 4408	4948	6D18.tmp	151
PID 4408 wrote to memory of 1968	4408	6E31.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-16_28af0169b8c5dd0e0090a5a10969a3d9_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_28af0169b8c5dd0e0090a5a10969a3d9_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\FB34.tmp
  "C:\Users\Admin\AppData\Local\Temp\FB34.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\FC0E.tmp
    "C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\F0.tmp
      "C:\Users\Admin\AppData\Local\Temp\F0.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\3EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EE.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\65F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65F.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\9AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AB.tmp"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\C1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1C.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\EDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDB.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\116B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\116B.tmp"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\14D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D6.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\1776.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1776.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\1A16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A16.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\1C87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C87.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\2001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2001.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\2169.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2169.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\2541.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2541.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\27D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27D1.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\2A62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A62.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\2CE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\2FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\32FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32FD.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\35BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35BC.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\37DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37DF.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\3975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3975.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\3D1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\3FAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\41B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41B2.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\4462.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4462.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\4740.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4740.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\49FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49FF.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\4D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\4F6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\5143.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5143.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\523D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\523D.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\52E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52E9.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\5402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5402.tmp"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\54DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54DD.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\55B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55B7.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\5700.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5700.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\5809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5809.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\58E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58E4.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\599F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\599F.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\5A7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\5B93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B93.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\5C7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\5DC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\5F2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\60C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60C4.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\61DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61DD.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\62A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62A8.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\6363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6363.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\642F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\642F.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\6529.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6529.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\6671.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6671.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\675B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\675B.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\6807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6807.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\68E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68E2.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\69BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69BC.tmp"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\6A97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A97.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\6B82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B82.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\6C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\6D18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D18.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\6E31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E31.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\6EFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"
        65⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\6FC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"
        66⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\7092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7092.tmp"
        67⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\716D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\716D.tmp"
        68⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\7248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7248.tmp"
        69⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\7313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7313.tmp"
        70⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\73FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73FD.tmp"
        71⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\74B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B9.tmp"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\7584.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7584.tmp"
        73⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\765F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\765F.tmp"
        74⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\7768.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7768.tmp"
        75⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\7814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7814.tmp"
        76⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\78DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78DF.tmp"
        77⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\79BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79BA.tmp"
        78⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\7A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A85.tmp"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\7B41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B41.tmp"
        80⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\7BFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"
        81⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\7CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"
        82⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\7D54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D54.tmp"
        83⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\7E4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"
        84⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\7F58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F58.tmp"
        85⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\8013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8013.tmp"
        86⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\80EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80EE.tmp"
        87⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\81C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81C9.tmp"
        88⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\82A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82A3.tmp"
        89⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\838E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\838E.tmp"
        90⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\8449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8449.tmp"
        91⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\8543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8543.tmp"
        92⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\861E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\861E.tmp"
        93⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\8708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8708.tmp"
        94⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\87F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87F3.tmp"
        95⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\88BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88BE.tmp"
        96⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\89B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89B8.tmp"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\8A93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A93.tmp"
        98⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\8B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"
        99⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\8C48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C48.tmp"
        100⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\8D23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D23.tmp"
        101⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\8DFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\8F07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F07.tmp"
        103⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\8FE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"
        104⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\90DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90DC.tmp"
        105⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\91A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A7.tmp"
        106⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\9272.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9272.tmp"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\936C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\936C.tmp"
        108⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\9437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9437.tmp"
        109⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\9522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9522.tmp"
        110⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\95FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95FD.tmp"
        111⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\96D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96D7.tmp"
        112⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\97A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97A2.tmp"
        113⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\986E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\986E.tmp"
        114⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\9968.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9968.tmp"
        115⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\9A23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A23.tmp"
        116⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\9ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"
        117⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\9B9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\9C75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C75.tmp"
        119⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\9D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D30.tmp"
        120⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\9E0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"
        121⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\9EE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"
        122⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\9FE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"
        123⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\A08C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A08C.tmp"
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\A157.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A157.tmp"
        125⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\A241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A241.tmp"
        126⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\A2DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\A3C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"
        128⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\A483.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A483.tmp"
        129⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\A520.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A520.tmp"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\A5FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"
        131⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\A6B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"
        132⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\A7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"
        133⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\A87B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A87B.tmp"
        134⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\A927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A927.tmp"
        135⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\A9F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"
        136⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\AACD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AACD.tmp"
        137⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\AB79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB79.tmp"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\AC44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC44.tmp"
        139⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\ACFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"
        140⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\ADCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"
        141⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\AE86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE86.tmp"
        142⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\AF61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF61.tmp"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\B02C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B02C.tmp"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\B106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B106.tmp"
        145⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\B1C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"
        146⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\B29D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B29D.tmp"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\B368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B368.tmp"
        148⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\B433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B433.tmp"
        149⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\B4FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"
        150⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\B5AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"
        151⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\B665.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B665.tmp"
        152⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        153⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\B7DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"
        154⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\B888.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B888.tmp"
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\B963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B963.tmp"
        156⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\BA1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"
        157⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\BADA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BADA.tmp"
        158⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\BBA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"
        159⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\BC51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC51.tmp"
        160⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\BD2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"
        161⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\BE07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE07.tmp"
        162⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\BEB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\BF7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"
        164⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\C049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C049.tmp"
        165⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\C0E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"
        166⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\C1A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"
        167⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\C24C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C24C.tmp"
        168⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\C327.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C327.tmp"
        169⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\C411.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C411.tmp"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\C4CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4CD.tmp"
        171⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\C588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C588.tmp"
        172⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\C644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C644.tmp"
        173⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\C71F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C71F.tmp"
        174⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\C7CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"
        175⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\C886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C886.tmp"
        176⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\C942.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C942.tmp"
        177⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\C9FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"
        178⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\CAB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"
        179⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\CB74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB74.tmp"
        180⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\CC30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC30.tmp"
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\CD0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"
        182⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\CDC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"
        183⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\CE81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE81.tmp"
        184⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\CF3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"
        185⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\D008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D008.tmp"
        186⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\D0E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"
        187⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\D18F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D18F.tmp"
        188⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\D24A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D24A.tmp"
        189⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\D315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D315.tmp"
        190⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\D3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"
        191⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\D49C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D49C.tmp"
        192⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\D548.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D548.tmp"
        193⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\D5F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"
        194⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\D6AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"
        195⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\D76B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D76B.tmp"
        196⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\D845.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D845.tmp"
        197⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\D910.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D910.tmp"
        198⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\D9CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"
        199⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\DAA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"
        200⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\DB72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB72.tmp"
        201⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\DC6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"
        202⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\DD27.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD27.tmp"
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\DE02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE02.tmp"
        204⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\DE8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"
        205⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\DF69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF69.tmp"
        206⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\E015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E015.tmp"
        207⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\E0E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"
        208⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\E18C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E18C.tmp"
        209⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\E238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E238.tmp"
        210⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\E303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E303.tmp"
        211⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\E3DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"
        212⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\E48A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E48A.tmp"
        213⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\E545.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E545.tmp"
        214⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\E5F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"
        215⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\E6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"
        216⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\E759.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E759.tmp"
        217⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\E814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E814.tmp"
        218⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\E8B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"
        219⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\E96C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E96C.tmp"
        220⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\EA47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA47.tmp"
        221⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\EAE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\EB7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"
        223⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\EC2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"
        224⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\ECF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"
        225⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\EDC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"
        226⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\EE5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\EF19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF19.tmp"
        228⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\EFD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"
        229⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\F090.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F090.tmp"
        230⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\F14C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F14C.tmp"
        231⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\F1F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"
        232⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\F294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F294.tmp"
        233⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\F34F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F34F.tmp"
        234⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\F3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"
        235⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\F4B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"
        236⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\F572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F572.tmp"
        237⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\F63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63D.tmp"
        238⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\F6E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"
        239⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\F7B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"
        240⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\F87F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F87F.tmp"
        241⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\F93B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F93B.tmp"
        242⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\F9E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"
        243⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\FAB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"
        244⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\FB7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"
        245⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\FC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC29.tmp"
        246⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\FCD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"
        247⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\FD81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD81.tmp"
        248⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\FE2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"
        249⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\FED8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FED8.tmp"
        250⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\FF75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF75.tmp"
        251⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30.tmp"
        252⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC.tmp"
        253⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\1A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A7.tmp"
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\243.tmp"
        255⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\2EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EF.tmp"
        256⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\39B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39B.tmp"
        257⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\447.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\447.tmp"
        258⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\522.tmp"
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\5DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DD.tmp"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\699.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\699.tmp"
        261⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\735.tmp"
        262⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\7E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E1.tmp"
        263⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\87D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87D.tmp"
        264⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\929.tmp"
        265⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\9E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E4.tmp"
        266⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\AA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA0.tmp"
        267⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\B5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5B.tmp"
        268⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\C17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C17.tmp"
        269⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\CB3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB3.tmp"
        270⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F.tmp"
        271⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\E3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3A.tmp"
        272⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15.tmp"
        273⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB1.tmp"
        274⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\104D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\104D.tmp"
        275⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\10F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10F9.tmp"
        276⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\11C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11C4.tmp"
        277⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\1270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1270.tmp"
        278⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\132B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\132B.tmp"
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\13E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13E7.tmp"
        280⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\1493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1493.tmp"
        281⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\154E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\154E.tmp"
        282⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\15EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15EB.tmp"
        283⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\16A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16A6.tmp"
        284⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\1762.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1762.tmp"
        285⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\180D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\180D.tmp"
        286⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\18B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18B9.tmp"
        287⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\1994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1994.tmp"
        288⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\1A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A30.tmp"
        289⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\1ADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"
        290⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\1B98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B98.tmp"
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\1C44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C44.tmp"
        292⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\1D0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"
        293⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\1DCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"
        294⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\1E86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E86.tmp"
        295⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\1F32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F32.tmp"
        296⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\1FFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"
        297⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\20A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20A9.tmp"
        298⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\2154.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2154.tmp"
        299⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\222F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\222F.tmp"
        300⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\22DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22DB.tmp"
        301⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\2397.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2397.tmp"
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\2481.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2481.tmp"
        303⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\253C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\253C.tmp"
        304⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\2608.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2608.tmp"
        305⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\26B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26B3.tmp"
        306⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\279E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279E.tmp"
        307⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\284A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\284A.tmp"
        308⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\2915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2915.tmp"
        309⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\29D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29D0.tmp"
        310⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\2A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"
        311⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\2B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B47.tmp"
        312⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\2BF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"
        313⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\2CBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"
        314⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\2D6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"
        315⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\2E16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E16.tmp"
        316⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\2EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"
        317⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\2F8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"
        318⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\3049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3049.tmp"
        319⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\30F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30F4.tmp"
        320⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\31B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31B0.tmp"
        321⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\327B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\327B.tmp"
        322⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\3337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3337.tmp"
        323⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\33F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33F2.tmp"
        324⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\34BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34BD.tmp"
        325⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\3569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3569.tmp"
        326⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\3625.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3625.tmp"
        327⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\36E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36E0.tmp"
        328⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\37AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37AB.tmp"
        329⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\3857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3857.tmp"
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\3903.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3903.tmp"
        331⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\39AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39AF.tmp"
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\3A6A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"
        333⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\3B16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B16.tmp"
        334⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\3BE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"
        335⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\3C7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"
        336⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\3D29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D29.tmp"
        337⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\3DE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\3EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EA0.tmp"
        339⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\3F5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"
        340⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\4008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4008.tmp"
        341⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\40D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40D3.tmp"
        342⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\417F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417F.tmp"
        343⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\423A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\423A.tmp"
        344⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\42F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42F6.tmp"
        345⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\43D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43D1.tmp"
        346⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\448C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\448C.tmp"
        347⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\4567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4567.tmp"
        348⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\4622.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4622.tmp"
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\46DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46DE.tmp"
        350⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\4799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4799.tmp"
        351⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\4884.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4884.tmp"
        352⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\494F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\494F.tmp"
        353⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\4A39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A39.tmp"
        354⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\4B04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B04.tmp"
        355⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\4BCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"
        356⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\4C9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C9B.tmp"
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\4D95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D95.tmp"
        358⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\4E40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E40.tmp"
        359⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\4EFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"
        360⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\4FB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"
        361⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\5073.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5073.tmp"
        362⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\514E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\514E.tmp"
        363⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\51FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51FA.tmp"
        364⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\52D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D4.tmp"
        365⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\53AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AF.tmp"
        366⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\547A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\547A.tmp"
        367⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\5536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5536.tmp"
        368⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\55F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55F1.tmp"
        369⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\569D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\569D.tmp"
        370⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\5778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5778.tmp"
        371⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\5833.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5833.tmp"
        372⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\58EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58EF.tmp"
        373⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\59BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59BA.tmp"
        374⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\5A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A85.tmp"
        375⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\5B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B50.tmp"
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\5C3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C3B.tmp"
        377⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\5D06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D06.tmp"
        378⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\5DC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"
        379⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\5E6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E6D.tmp"
        380⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\5F38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F38.tmp"
        381⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\5FE4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"
        382⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\60BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60BF.tmp"
        383⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\618A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\618A.tmp"
        384⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\6245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6245.tmp"
        385⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\6311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6311.tmp"
        386⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\63CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63CC.tmp"
        387⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\6478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6478.tmp"
        388⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\6562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6562.tmp"
        389⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\660E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\660E.tmp"
        390⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\66F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66F9.tmp"
        391⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\6795.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6795.tmp"
        392⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\6860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6860.tmp"
        393⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\694A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\694A.tmp"
        394⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\6A06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A06.tmp"
        395⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\6AB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AB2.tmp"
        396⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\6B7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B7D.tmp"
        397⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\6C29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C29.tmp"
        398⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\6CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CF4.tmp"
        399⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\6DA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"
        400⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\6E9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E9A.tmp"
        401⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\6F55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F55.tmp"
        402⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\7011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7011.tmp"
        403⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\70CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70CC.tmp"
        404⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\7197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7197.tmp"
        405⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\7253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7253.tmp"
        406⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\72EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72EF.tmp"
        407⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\73AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73AB.tmp"
        408⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\7476.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7476.tmp"
        409⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\7550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7550.tmp"
        410⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\762B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\762B.tmp"
        411⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\78FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78FA.tmp"
        412⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\79C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79C5.tmp"
        413⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\7A61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A61.tmp"
        414⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\7B4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B4C.tmp"
        415⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\7C07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C07.tmp"
        416⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\7CA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"
        417⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\7D7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"
        418⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\7E3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"
        419⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\7F34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F34.tmp"
        420⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\7FD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FD0.tmp"
        421⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\80DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80DA.tmp"
        422⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\8195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8195.tmp"
        423⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\8241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8241.tmp"
        424⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\830C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\830C.tmp"
        425⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\83C8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83C8.tmp"
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\84A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84A2.tmp"
        427⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\855E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\855E.tmp"
        428⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\8629.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8629.tmp"
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\86D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86D5.tmp"
        430⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\8790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8790.tmp"
        431⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\885B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\885B.tmp"
        432⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\8927.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8927.tmp"
        433⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\89D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89D2.tmp"
        434⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\8A7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A7E.tmp"
        435⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\8B3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"
        436⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\8BE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"
        437⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\8CA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"
        438⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\8D6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D6C.tmp"
        439⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\8E09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E09.tmp"
        440⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\8EC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"
        441⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\8F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F80.tmp"
        442⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\903B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\903B.tmp"
        443⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\9106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9106.tmp"
        444⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\91A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A2.tmp"
        445⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\925E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\925E.tmp"
        446⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\930A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\930A.tmp"
        447⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\93C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93C5.tmp"
        448⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\9471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9471.tmp"
        449⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\951D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\951D.tmp"
        450⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\95C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95C9.tmp"
        451⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\9675.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9675.tmp"
        452⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\9721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9721.tmp"
        453⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\97EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97EC.tmp"
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\98B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98B7.tmp"
        455⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\9953.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9953.tmp"
        456⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\9A2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A2E.tmp"
        457⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\9AE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"
        458⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\9BA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"
        459⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\9C51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C51.tmp"
        460⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\9D2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"
        461⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\9DD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DD7.tmp"
        462⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\9E93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E93.tmp"
        463⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\9F6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F6E.tmp"
        464⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\A039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A039.tmp"
        465⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\A0F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0F4.tmp"
        466⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\A1BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1BF.tmp"
        467⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\A26B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A26B.tmp"
        468⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\A356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A356.tmp"
        469⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\A402.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A402.tmp"
        470⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\A4CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"
        471⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\A569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A569.tmp"
        472⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\A644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A644.tmp"
        473⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\A6FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6FF.tmp"
        474⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\A7DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7DA.tmp"
        475⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\A895.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A895.tmp"
        476⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\A951.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A951.tmp"
        477⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\AA0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA0C.tmp"
        478⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\AAC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAC8.tmp"
        479⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\ABA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"
        480⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\AC4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"
        481⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\AD29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD29.tmp"
        482⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\ADE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADE5.tmp"
        483⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\AECF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AECF.tmp"
        484⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\AF9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF9A.tmp"
        485⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\B065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B065.tmp"
        486⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\B131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B131.tmp"
        487⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\B1FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"
        488⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\B2A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2A8.tmp"
        489⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\B363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B363.tmp"
        490⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\B43E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B43E.tmp"
        491⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\B519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B519.tmp"
        492⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\B5F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5F3.tmp"
        493⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\B6AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6AF.tmp"
        494⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\B799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B799.tmp"
        495⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\B864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B864.tmp"
        496⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\B93F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B93F.tmp"
        497⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\BA0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0A.tmp"
        498⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\BAC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAC6.tmp"
        499⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\BB81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB81.tmp"
        500⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\BC4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4C.tmp"
        501⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\BD08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD08.tmp"
        502⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\BDC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"
        503⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\BE7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"
        504⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\BF1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"
        505⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\BFD7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFD7.tmp"
        506⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\C0A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0A2.tmp"
        507⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\C18C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C18C.tmp"
        508⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\C248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C248.tmp"
        509⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\C322.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C322.tmp"
        510⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\C3BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3BF.tmp"
        511⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\C4A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4A9.tmp"
        512⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\C5A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5A3.tmp"
        513⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\C63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C63F.tmp"
        514⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\C6EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6EB.tmp"
        515⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\C797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C797.tmp"
        516⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\C872.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C872.tmp"
        517⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\C93D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C93D.tmp"
        518⤵
        System Location Discovery: System Language Discovery
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\CA08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA08.tmp"
        519⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\CAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAB4.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\CB6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB6F.tmp"
        521⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\CC0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC0C.tmp"
        522⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\CCE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"
        523⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\CDB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB1.tmp"
        524⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\CE8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE8C.tmp"
        525⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\CF48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF48.tmp"
        526⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\CFF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFF4.tmp"
        527⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\D0CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0CE.tmp"
        528⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\D199.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D199.tmp"
        529⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\D255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D255.tmp"
        530⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\D301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D301.tmp"
        531⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\D3DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3DC.tmp"
        532⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\D4D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4D6.tmp"
        533⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\D581.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D581.tmp"
        534⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\D63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D63D.tmp"
        535⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\D6F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F8.tmp"
        536⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\D7D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7D3.tmp"
        537⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\D88F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D88F.tmp"
        538⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\D94A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D94A.tmp"
        539⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\D9F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9F6.tmp"
        540⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\DAB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAB2.tmp"
        541⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\DB6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB6D.tmp"
        542⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\DC38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC38.tmp"
        543⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\DD13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD13.tmp"
        544⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\DDBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDBF.tmp"
        545⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\DE9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE9A.tmp"
        546⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\DF45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF45.tmp"
        547⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\E011.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E011.tmp"
        548⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\E0CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0CC.tmp"
        549⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\E197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E197.tmp"
        550⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\E253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E253.tmp"
        551⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\E30E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E30E.tmp"
        552⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\E3BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"
        553⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\E466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E466.tmp"
        554⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\E531.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E531.tmp"
        555⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\E5ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5ED.tmp"
        556⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\E689.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E689.tmp"
        557⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\E764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E764.tmp"
        558⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\E84E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E84E.tmp"
        559⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\E919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E919.tmp"
        560⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\E9D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D5.tmp"
        561⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\EAAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAAF.tmp"
        562⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\EB7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB7A.tmp"
        563⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\EC26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC26.tmp"
        564⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\ED11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED11.tmp"
        565⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\EDBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDBD.tmp"
        566⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\EE97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE97.tmp"
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\EF62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF62.tmp"
        568⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\F02E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F02E.tmp"
        569⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\F108.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F108.tmp"
        570⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\F1C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1C4.tmp"
        571⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\F27F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F27F.tmp"
        572⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\F31C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F31C.tmp"
        573⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\F3D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3D7.tmp"
        574⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\F4A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F4A2.tmp"
        575⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\F53E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F53E.tmp"
        576⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\F60A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F60A.tmp"
        577⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\F6D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6D5.tmp"
        578⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\F790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F790.tmp"
        579⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\F86B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F86B.tmp"
        580⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\F917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F917.tmp"
        581⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\F9E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9E2.tmp"
        582⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\FA9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA9D.tmp"
        583⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\FB69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB69.tmp"
        584⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\FC14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC14.tmp"
        585⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\FCFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCFF.tmp"
        586⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\FDAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDAB.tmp"
        587⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\FE66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE66.tmp"
        588⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\FF7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF7F.tmp"
        589⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B.tmp"
        590⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\106.tmp"
        591⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\1F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F0.tmp"
        592⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\29C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29C.tmp"
        593⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\387.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\387.tmp"
        594⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\433.tmp"
        595⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\4FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE.tmp"
        596⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\5C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C9.tmp"
        597⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\6B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3.tmp"
        598⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\77E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E.tmp"
        599⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\869.tmp"
        600⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\943.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\943.tmp"
        601⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\9FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FF.tmp"
        602⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\ACA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACA.tmp"
        603⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\B76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B76.tmp"
        604⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\C41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C41.tmp"
        605⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFD.tmp"
        606⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\DC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC8.tmp"
        607⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\EA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA2.tmp"
        608⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\F6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6E.tmp"
        609⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\1058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1058.tmp"
        610⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\1104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1104.tmp"
        611⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\11FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11FE.tmp"
        612⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        613⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\1384.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1384.tmp"
        614⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\1440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1440.tmp"
        615⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\150B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\150B.tmp"
        616⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\15C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15C7.tmp"
        617⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\1692.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1692.tmp"
        618⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\174D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\174D.tmp"
        619⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\1809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1809.tmp"
        620⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\18C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C4.tmp"
        621⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\1970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1970.tmp"
        622⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\1A4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A4B.tmp"
        623⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\1AF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AF7.tmp"
        624⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\1BB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB2.tmp"
        625⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\1C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C8D.tmp"
        626⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\1D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D58.tmp"
        627⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\1E42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E42.tmp"
        628⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\1EFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EFE.tmp"
        629⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\1FC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FC9.tmp"
        630⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\2094.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2094.tmp"
        631⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\218E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\218E.tmp"
        632⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\223A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\223A.tmp"
        633⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\2305.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2305.tmp"
        634⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\23D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23D0.tmp"
        635⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\249B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\249B.tmp"
        636⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\2557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2557.tmp"
        637⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\2612.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2612.tmp"
        638⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\26DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26DE.tmp"
        639⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\27A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27A9.tmp"
        640⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\2874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2874.tmp"
        641⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\292F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\292F.tmp"
        642⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\2A1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1A.tmp"
        643⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\2AE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AE5.tmp"
        644⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\2BC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC0.tmp"
        645⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\2CAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CAA.tmp"
        646⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\2D65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D65.tmp"
        647⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\2E5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E5F.tmp"
        648⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\2F1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F1B.tmp"
        649⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\2FF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"
        650⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\30A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30A2.tmp"
        651⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\315D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\315D.tmp"
        652⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\3228.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3228.tmp"
        653⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\3313.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3313.tmp"
        654⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\33ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33ED.tmp"
        655⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\34D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34D8.tmp"
        656⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\35B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35B2.tmp"
        657⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\368D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\368D.tmp"
        658⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\3729.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3729.tmp"
        659⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\3823.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3823.tmp"
        660⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\38FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38FE.tmp"
        661⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\39C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39C9.tmp"
        662⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\3AA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AA4.tmp"
        663⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\3B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B50.tmp"
        664⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\3C5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C5A.tmp"
        665⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\3D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D25.tmp"
        666⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\3DD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DD1.tmp"
        667⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\3E9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E9C.tmp"
        668⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        669⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\4051.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4051.tmp"
        670⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\413C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\413C.tmp"
        671⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\4255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4255.tmp"
        672⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\4301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4301.tmp"
        673⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\43CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43CC.tmp"
        674⤵
        
        PID:6868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

116B.tmp

Path C:\Users\Admin\AppData\Local\Temp\116B.tmp
Size 3.6MB
SHA256 4f843af7b1f7ad958c1207e0dcc58c941bc1b747b247892e46162bebb5669888
MD5 3a63bf56c592e9aed1f66d9588027919
SHA1 cf589d5841ed7a44dae873de131d911e0529b913
SHA512 3cc168267ecb21f6827f454879900b76eafeb06f04f129ee56ce3172a678ded863bb03b58cad0f2da83365e58957740e3d7bdb66c4727eaac6cef37d794bd7ba
SSDEEP 49152:w/OJDg+Km7C+NGEADt7i+/yTukuFGNLrkBirx:EORFC+chrSiGdkBirx
TLSH
T19006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\14D6.tmp
Size 3.6MB
SHA256 e7e1638b9f1cf796459152da38b8233340850d271f90e4c3b338a31fa13da7c0
MD5 f33c17797515b530827745ab87335b90
SHA1 9d25ea37dadd88b802563b3c0bf61d17cdb31ecd
SHA512 803bcfff67a55d0926a21c07e3b1f8e978a16a41091c6cdd9d96933e19075d737257d404203c8be18dc76ee6be0e41938aa922a85392e0354c428382efae5eef
SSDEEP 49152:w/OJDms3rwiwJTnNGEADt7i+/yTukuFGNLrkBirx:EOos7wiwJTnchrSiGdkBirx
TLSH
T1FB06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1776.tmp

Path C:\Users\Admin\AppData\Local\Temp\1776.tmp
Size 3.6MB
SHA256 b91f7f9668cc6b48faf1a7251c31f4d5fa379aeecd45d08eec2754f753da2482
MD5 e4c8d0640b8afbf227a4649454d11af7
SHA1 91924ba84d25cd60ba68893aca58c3e028ef1a5d
SHA512 25dc9196bc0c59150eda7ee54613fb71c9a424019625d1a786211092058cf82a55fddb027220874f4b0aca1d3f38d9d2b3f22be1e87b1fe7f339a2b82b59f562
SSDEEP 49152:w/OJDPzUifNGEADt7i+/yTukuFGNLrkBirx:EORXfchrSiGdkBirx
TLSH
T18E06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A16.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A16.tmp
Size 3.6MB
SHA256 47c665a17e177dfc7bf3922ab7187f733c048331b7f4c1d934c203fc5bb0daab
MD5 d152432dd82acf2da8a4542139e0e6eb
SHA1 70f095a0b261c19d11c1da7f292894ebbcb97e02
SHA512 248859027b69ffa9b64c76d5142805bfe07598237f9fe2631ba81f1d0d3fa89533d8c72fa4f54aaf02e4971f26ba5540f787c5c03d5e829bb0340fe744c0191b
SSDEEP 49152:w/OJD6eMVNGEADt7i+/yTukuFGNLrkBirx:EO8HVchrSiGdkBirx
TLSH
T1C906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1C87.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C87.tmp
Size 3.6MB
SHA256 c2b16e0eda277005adc1f5a9332a5b5a30f708d27fc17f56a8141ab04293f8e4
MD5 72e98c5741fdbb1eabc34e390b1637af
SHA1 2e109a10c24403d04171bbb9fc8abd75fa9a625d
SHA512 297b978a65c40f720fc00bd9b5693c3d3305167335c64fc9a9f6932cfb731e049f6325a4a5010e0c07adbd218f5c8268e5d5db7287593d784a67a2a3cf0a86d0
SSDEEP 49152:w/OJDODfadkPiyNGEADt7i+/yTukuFGNLrkBirx:EOQDfaFychrSiGdkBirx
TLSH
T1F906831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2001.tmp

Path C:\Users\Admin\AppData\Local\Temp\2001.tmp
Size 3.6MB
SHA256 b6dd414fd0cc11f3f98ac4b5379c0f5f7fa4cd41123e009bd9951815362fae80
MD5 2a463d6faf257dea81bc7ab2c3026f13
SHA1 674fe522a2aff29e387b94d9ea541e37ca1d821a
SHA512 09bc3bd53bf5631e0322698a4214988588cdb5d05a9d9578cefb0c3f7e6a68f1dca507655108830ec6ef904482dad461103beec5b9a066376e8937c928d94e5e
SSDEEP 49152:w/OJDn6fZmNGEADt7i+/yTukuFGNLrkBirx:EOc8chrSiGdkBirx
TLSH
T10006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2169.tmp

Path C:\Users\Admin\AppData\Local\Temp\2169.tmp
Size 3.6MB
SHA256 83d74a8ade7dbcb760050e0d8782cd65950658b23e6464b6c8dcd8ecac6e48e1
MD5 79999e21c2ab24dd9ab8770235840ea2
SHA1 f500416442a5a4c36da28624fb3181f05de17cbe
SHA512 a19f47e8916e358408a12cacddaba1471e42a90c28cc0cfe23dba76a0c12442a32c996691fe996e88791be0a6f6a3827480782b9ae896aa7661e2b2e8e6cf6fc
SSDEEP 49152:w/OJD7FsveGzwINGEADt7i+/yTukuFGNLrkBirx:EO90zfchrSiGdkBirx
TLSH
T15C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2541.tmp

Path C:\Users\Admin\AppData\Local\Temp\2541.tmp
Size 3.6MB
SHA256 cdcf94705b683b5d8f5347c5e7f33b75eca3f20be462335b4cb3279c91729a20
MD5 0133f0303ef57f7044d62c4a6d097a20
SHA1 ae1210dfb1414a28a7f4724ceb68cc98bfad030e
SHA512 f844b803fc4762deb22fa3d7e313c73811af0ec773d2388bd969aa90e4805078e7db63a781fef6f8bec97d50370303012934a74c248bdd1bb5cb0153a7e9699e
SSDEEP 49152:w/OJD1NSLnuTNGEADt7i+/yTukuFGNLrkBirx:EO9OachrSiGdkBirx
TLSH
T11D06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\27D1.tmp
Size 3.6MB
SHA256 badc2db5d2841f4c608278e074694f9e7c14e4ab845606d55ceacda854f50f4c
MD5 65fb5b251936b42baf88b4e243d24cdf
SHA1 31bc98d524aa58bcce4303d5129df0368d571809
SHA512 98ccdba29a49196c64d935bcc0b2bc624d3f21875bd68f9f779b5f3fbae86b500ce14d4ad539782693cc7f4f16443a7d390c89e8b9d9655b8b73fbfa1659e0f7
SSDEEP 49152:w/OJDahgqNvNGEADt7i+/yTukuFGNLrkBirx:EOIqqchrSiGdkBirx
TLSH
T13406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2A62.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A62.tmp
Size 3.6MB
SHA256 8b1b14485eb5edc0b736da7e9150725b1b3e6f09c2214a29f3aadd108344b06e
MD5 7aa770be859c889c09459bf644fb5184
SHA1 1ce56c1ba694d86e1fdc27812226c5ee787ded2e
SHA512 b3f034ffff2aef402737d2f9d112e1f5a262394f816fa1f2af8937844063a266372e389d87cf32178eb4bf2fb11438f9450905b50beb53ee716e08b65ca416b0
SSDEEP 49152:w/OJDxLbZ1iNGEADt7i+/yTukuFGNLrkBirx:EODichrSiGdkBirx
TLSH
T19306931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2CE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\2CE2.tmp
Size 3.6MB
SHA256 580fa7f259f96b726b383566db51adeb8d5e80c3d46e169ea11ea00229a32d02
MD5 d9a14447fb89ab3744db3ad968dab96c
SHA1 a52c93640c32431fc69728466743981329a3b36a
SHA512 0fbb284e090b2d3779f5b2c3afaa4fe9a4c52e00daac05d2dfb200e8fd9e6a58f5a884749e46492c91aeeacf6a2e74d719d659a538566b3b61aac766ed434a35
SSDEEP 49152:w/OJDMReNGEADt7i+/yTukuFGNLrkBirx:EOSechrSiGdkBirx
TLSH
T11306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2FA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2FA1.tmp
Size 3.6MB
SHA256 a0d1df412d6d0636369dc0ab3a854e0052a41bff99aa66fa2a9ec64976b2fe60
MD5 dee4207f5b93530e0e43965357bf7aa0
SHA1 75b5bc70a19f68f21a7a7fdf8de916888ea6c6ea
SHA512 564a3b473027581d168ade8d4027a82f83acbe1419d726018ef6c262b5b8f2d6e1e274da61855db1b7c5d10b4fef0c59bd5c4c11e2963de1579245d02e1e09c1
SSDEEP 49152:w/OJD8m1mFxNGEADt7i+/yTukuFGNLrkBirx:EOmfchrSiGdkBirx
TLSH
T12806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\32FD.tmp
Size 3.6MB
SHA256 2b5054b41a91c62cf564d74eb4de6f5c66b3b57b1725e0ccadd358241951c9cc
MD5 e22a8aa28fcd6c808565feba16660e29
SHA1 211577275e6196cbefb2d32d20c699c00de0288a
SHA512 96512fd8597854bebfad0bd6352b05e776e84d1a9f563f09bf271b795976ca713ca5136d072fa75b7b9178bd4e373f57711cb1a68fe1032457f66c531b7ee5b9
SSDEEP 49152:w/OJDlZI9L9vNGEADt7i+/yTukuFGNLrkBirx:EOnZYL9vchrSiGdkBirx
TLSH
T1BA06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\35BC.tmp
Size 3.6MB
SHA256 8fdb3d79a8a4ef279f0e364f286ac1e98a73aefb5722c00882694fec435a93f0
MD5 4cc65f2e44e92f60c2cf366313d0fc85
SHA1 d7e2aeecbd83220325b9912633ac04f61d85df2f
SHA512 14b03692b1531eb99fc971ac0be68cddf80d1ceaa1827af6c0d4df3637613243be9392215a51bfa05a700f3ee045cd981950cb5880d9ed81677d933145f8b557
SSDEEP 49152:w/OJD6mapKNGEADt7i+/yTukuFGNLrkBirx:EOgmuKchrSiGdkBirx
TLSH
T1D806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\37DF.tmp
Size 3.6MB
SHA256 b2d855cf4f67b212a8d57b41f6e14e086f7488853b4091d8ec21a3f39b266085
MD5 7a21559b9097685757fc743bea01c48c
SHA1 beed556ff41805ceee32bdee817aa2eb56a5d870
SHA512 6da99fb2db80901fd1f715c8eb2d0a1334abd76b43a9ae3139fe1bd2aea4700eeb2579f9b1a2de13eda0a4f5abd7d5a5c0725e50be76547d360a7d2b397af273
SSDEEP 49152:w/OJDpXuqWUv1MNGEADt7i+/yTukuFGNLrkBirx:EOD2chrSiGdkBirx
TLSH
T10406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3975.tmp

Path C:\Users\Admin\AppData\Local\Temp\3975.tmp
Size 3.6MB
SHA256 23b96ab0cc1c8bf18beff6a23be1ac38917e4854c2c12ea2a280ebc8e6d63b28
MD5 a4856571893a7db4d76a3b93f7c13b33
SHA1 976ec562cafa1ac17ffed560aa03a347042d55bb
SHA512 d2431aa6593431e23e7ba4f567e8facc26f4206d35f314eb3c638e1a2c2324b0030571f24d5fed5faa19ea82edce410539a6dfaa075c5192a105ea88d73d3d5e
SSDEEP 49152:w/OJDUrRMeo5wONNGEADt7i+/yTukuFGNLrkBirx:EOQyDwONchrSiGdkBirx
TLSH
T15F06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D1F.tmp
Size 3.6MB
SHA256 ac4e44dc5ec346f7ea385a8f6e3643c2a6c21996a2c064085fc3618def324907
MD5 3086d380c2ead05f9d837994d779e9cc
SHA1 6cabd25bb832d50ffcc55ccb5a06157708c0e126
SHA512 04364b182ca240790efac08c9ae8900459760aae4f9b0061e75d299394ba2f9f99d47836b8f10b5734ea3e16c5f88046167b410a7c0215210ce5503248ff07eb
SSDEEP 49152:w/OJDar8mXJBKJNGEADt7i+/yTukuFGNLrkBirx:EOMNJBkchrSiGdkBirx
TLSH
T14206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EE.tmp
Size 3.6MB
SHA256 629e9f0af6c59e88699e5842099ec923e8dffb743481d0d52762d80a732e163f
MD5 3c84b581637db5bd0a4d84231533f0d3
SHA1 6ff96a618735b39f22ab4c661a42c336f56abcd2
SHA512 235d85fa0cd55f3f010efa9b3d7f9e3f02d70da8d2db4e19e0b43541b1a59836ed5c1c415bd0f47a3fba817874155ca69c7cfb1903e4f066542054e1d61a42d1
SSDEEP 49152:w/OJD0aGJfRsQWNGEADt7i+/yTukuFGNLrkBirx:EO1kfCQWchrSiGdkBirx
TLSH
T14E06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3FAF.tmp
Size 3.6MB
SHA256 87dcdb1824ef7bf608aff18cf811c4e8d93a0a17e5c0884f9d446a8e438a2e54
MD5 dbc8c52793fac7c37f00381169f70e14
SHA1 5fca97d82a7acad4d067b1b155ee4930200b713b
SHA512 e2cb2f48a1526a99c65fcebfaa20ccaacecfe842df197bd657b1aecc9e92414ab123841d7d28271af6d57bd3f748f47656d072b48a67dffb80033edf59022559
SSDEEP 49152:w/OJDTDR4jdc4NGEADt7i+/yTukuFGNLrkBirx:EO1yjdc4chrSiGdkBirx
TLSH
T19E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\41B2.tmp
Size 3.6MB
SHA256 4f7cc0762ff6cab9db340ff8c1b10a9055332871662f4d4fce443d4e100276bf
MD5 706b7aa975667fc0b9cd3a850b485718
SHA1 1d2689a3699eb4e3b997e9b59f770a9c8a47591a
SHA512 f187d7b012fcb68525d5775d62980c7f7f9af51c48f6ebae9a051eaddf16ea768a1a65eedd76b268ab8d2b837425c0327e47bf61b37a68cfa771f7ae7d64367f
SSDEEP 49152:w/OJDwS/08lNGEADt7i+/yTukuFGNLrkBirx:EOGSs8lchrSiGdkBirx
TLSH
T1DF06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4462.tmp

Path C:\Users\Admin\AppData\Local\Temp\4462.tmp
Size 3.6MB
SHA256 b3a3b617f2aa5bc1d6ecf86556ca135c1584f8392a0ac4cafc93eb9ead9ea037
MD5 473f5564719a905c45597644cb571149
SHA1 531e904c6a3d694b81efc548218cf665ae555c22
SHA512 eb486726ab44034aff65194b43580dd449b97ea22773044f493f60ade3d19e37b987ba1371a7a9604fa223ddf081ec505db2085f50a78644861c0a691a13a769
SSDEEP 49152:w/OJDR03RuRYfo4NGEADt7i+/yTukuFGNLrkBirx:EOL03oYQ4chrSiGdkBirx
TLSH
T18706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4740.tmp

Path C:\Users\Admin\AppData\Local\Temp\4740.tmp
Size 3.6MB
SHA256 261d4f60781dc2b8353fb7fb4585f021f6f675c1de7289c22bee5d53468ff875
MD5 f4fad972566fcfe878d1ec677299df54
SHA1 569c0086034643192637c9e0b2cca9226a93a5d8
SHA512 bf11a2806de98ecbee6787e56dd25c02c0a7a4263de94e64c64064a3e85ccc04699bc224e78cbbcb1aa88bd8151e60c992e39e39ea2dcce35e81661d2253bfb6
SSDEEP 49152:w/OJDd0BTGFa4lNGEADt7i+/yTukuFGNLrkBirx:EOBxchrSiGdkBirx
TLSH
T16D06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\49FF.tmp
Size 3.6MB
SHA256 c7475de5b3630c9a0002b1f26e4a37d00a01780979d78109e043ea5d4823bcf1
MD5 af54824c55fd14abd76120e528f92660
SHA1 5ced400d5cdf975d9b2c5d7fb03b8a8f5d71526d
SHA512 57716760582a1a554990b03439ff2bbdb318cac86969eee394da616382973345f70a30a73fafb744f92244d996e4079a5bb3113f725f1e86b0738dabffd5036c
SSDEEP 49152:w/OJD+KoXmp+oNGEADt7i+/yTukuFGNLrkBirx:EO4KoXYBchrSiGdkBirx
TLSH
T18406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D2C.tmp
Size 3.6MB
SHA256 e0ac82711a0f5d7501aa120300df3791b20c94af7a950d392be263dde65220af
MD5 cb090576b006a075c4ba1454e66125e6
SHA1 b4aec9e40c4e30d648abbdcaf7b9b892cd632da1
SHA512 e5566e3e62578c4206588bc9fa9ccd4cdaecda9292d10468b01d9f2f275b2ac59e36dc0e3f31d275d618fd396f6ff9eab79aa79fff3940023163a49043f7cf7e
SSDEEP 49152:w/OJDOceTWNGEADt7i+/yTukuFGNLrkBirx:EOwLTWchrSiGdkBirx
TLSH
T11B06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4F6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F6E.tmp
Size 3.6MB
SHA256 20640700c1e43d71facfd864c3c63bcd15ca1b32ccc862853b49a65789572d4b
MD5 8ad54e03648db6bce3a5481df2bbf58b
SHA1 e75899edc68b4522f719343e41938eb0b4274cd8
SHA512 c53be42f8112d1bc0b0349790ffc8206e34d1383b20f0e2ce4660d37def9abd7ecc35e394feefbd7ab7f903e14165e2174de5ac17f48c67c1f75406ca12586eb
SSDEEP 49152:w/OJDYRUzOOoVcNINGEADt7i+/yTukuFGNLrkBirx:EO2pVcGchrSiGdkBirx
TLSH
T1F006831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65F.tmp

Path C:\Users\Admin\AppData\Local\Temp\65F.tmp
Size 3.6MB
SHA256 c9918bb935448606ad2513934e0d940ca58e303cc265a3ad470d63093bce7d09
MD5 24f74ba79c98c2205859ad888a077aa9
SHA1 c2e85664c82bed774d8c000fd33b93f979cc250c
SHA512 f1483104eb8e5929c1d5aab9701009fcd803f0dbb12cb6eda6d4d7925c11e56a5c7412d4ea21ebe5059eed8488c830641a625a08233c35556ecd2e0584f1873f
SSDEEP 49152:w/OJDSZGUu0mdNGEADt7i+/yTukuFGNLrkBirx:EO41u0EchrSiGdkBirx
TLSH
T1C306831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\9AB.tmp
Size 3.6MB
SHA256 ae47d8f5c724e9cb42cadb924ce9012cf685a9183722e0bfb50bfd867ab41098
MD5 a60aec58205047b3af0426195fae751a
SHA1 3bb3fe1fee21ef0764a9a197966e76960c9c26e9
SHA512 bc77f66cee5cea5bb0c5fba302c7127fa404b078419d6867f1738c59c400ac5db6dc7f29573dbce217f1b9107a51d2064d4ed1cf4d4b22ef378626f785aedf5d
SSDEEP 49152:w/OJDmGkv8su5KH8NGEADt7i+/yTukuFGNLrkBirx:EOiksu5m8chrSiGdkBirx
TLSH
T11006931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\C1C.tmp
Size 3.6MB
SHA256 82505592587d8e60e5d08c041159baad3b32324dffb9bbdb9a0e2cd6d130ce8f
MD5 e9a52d234ff2282129ab4547950684eb
SHA1 36190d9d2e6aba794d9df4f4515c89feaeddfa6c
SHA512 fd31ffd2f70a40de3352f636fce8405f8d6829c2d59e1bdfa3de5aff2e446dcd985b87debe52c50c95b3b051b41490d7f0524435511dd144ee4b741166ed6a3e
SSDEEP 49152:w/OJDIWSxWvNGEADt7i+/yTukuFGNLrkBirx:EOSQvchrSiGdkBirx
TLSH
T1D406931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\EDB.tmp
Size 3.6MB
SHA256 c676283a76f5a8a5bd95b56a1e94b6fa5e6e86c69143a09789692f11223edcfe
MD5 2125cc6b35c0538fe927bc6277f426a9
SHA1 00a57c31809903e424ab6789d6900e361cb5c29d
SHA512 7e54bde1997b63b7842cf30bc465194584b5691e3a228df58d30ca9eefccdccc98b1fca40a78b1ec84ca998ea6281f97f1219b9869ea241ce867db0a330a04ec
SSDEEP 49152:w/OJDY/dgmP+NGEADt7i+/yTukuFGNLrkBirx:EOKajchrSiGdkBirx
TLSH
T12106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\F0.tmp
Size 3.6MB
SHA256 8b4afa8f584ce49b81cf5cda797a79c81cf007f2497c1f8b289e7a4b2a71ad80
MD5 fd01a20c61739cb1687240a820e05b03
SHA1 91083611203824d5847d4074abd8539f573c10b9
SHA512 050575529b1b1bcf7e21f36ecf9f602e3622fd37ee4949a2dc20e206636313c44430262a82ceaf7686537d0bbcee75e3b2352273cf75fcf34dbb2ce27495b94e
SSDEEP 49152:w/OJDFRGC6cNEViXZNGEADt7i+/yTukuFGNLrkBirx:EObR8WlXZchrSiGdkBirx
TLSH
T11106831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FB34.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB34.tmp
Size 3.6MB
SHA256 c7474acfb6b1281ac3a83b025bad06d728daf6793de36d16986587397c7c19ba
MD5 61eca478571fec8f6d10ad323ed1cba9
SHA1 666c7280524fda7c72035ec87591d38f29a7574f
SHA512 3a31265830567352a3d74a2bba2cd0357671e1517ed6780f7b88c68d3c5035309ccb5daa7dcb08f0283cd909d4afa1c74a4dbc741dbcee4fda56325a7c32b1f4
SSDEEP 49152:w/OJDAFCdNJ0eRNGEADt7i+/yTukuFGNLrkBirx:EO4m02chrSiGdkBirx
TLSH
T1C806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FC0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC0E.tmp
Size 3.6MB
SHA256 1d3667454e41c852aa5da57934814f01ac457436943db176ab60054981170557
MD5 8b9dc88eb04fc6c8750f6eba36ae275e
SHA1 d76ec9252f8a28318ad9bafc55456777567447a4
SHA512 c3d0672196b87a41d3b3c1965c791662f4d38a944f0989fc921101f8de44bbff4ee447bc00111072582c247a455f2043dccbb327ae6866789ce29ad2115022e8
SSDEEP 49152:w/OJDpIL/560/NGEADt7i+/yTukuFGNLrkBirx:EOQ5F/chrSiGdkBirx
TLSH
T1A806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/348-123-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/348-131-0x0000000000D40000-0x0000000000DC3000-memory.dmp

Download

memory/564-233-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/564-239-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/1300-216-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/1300-208-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/1384-144-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/1384-152-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/1476-263-0x0000000000BF0000-0x0000000000C73000-memory.dmp

Download

memory/1476-267-0x0000000000BF0000-0x0000000000C73000-memory.dmp

Download

memory/1548-27-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/1548-19-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/1852-203-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/1852-194-0x0000000000140000-0x00000000001C3000-memory.dmp

Download

memory/2088-273-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/2088-268-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/2196-173-0x0000000000940000-0x00000000009C3000-memory.dmp

Download

memory/2196-165-0x0000000000940000-0x00000000009C3000-memory.dmp

Download

memory/2244-229-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/2244-222-0x00000000008D0000-0x0000000000953000-memory.dmp

Download

memory/2264-117-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/2264-124-0x00000000009E0000-0x0000000000A63000-memory.dmp

Download

memory/2412-137-0x00000000000C0000-0x0000000000143000-memory.dmp

Download

memory/2412-130-0x00000000000C0000-0x0000000000143000-memory.dmp

Download

memory/2436-224-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/2436-215-0x0000000000F10000-0x0000000000F93000-memory.dmp

Download

memory/2536-83-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/2536-75-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/2564-89-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2564-97-0x00000000001C0000-0x0000000000243000-memory.dmp

Download

memory/2820-54-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/2820-61-0x0000000000BE0000-0x0000000000C63000-memory.dmp

Download

memory/2852-302-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/2868-0-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/2868-6-0x00000000000B0000-0x0000000000133000-memory.dmp

Download

memory/2900-40-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2900-47-0x0000000000850000-0x00000000008D3000-memory.dmp

Download

memory/2940-258-0x0000000000040000-0x00000000000C3000-memory.dmp

Download

memory/3012-283-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/3012-278-0x0000000000610000-0x0000000000693000-memory.dmp

Download

memory/3048-254-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/3048-248-0x0000000000AB0000-0x0000000000B33000-memory.dmp

Download

memory/3324-303-0x00000000003F0000-0x0000000000473000-memory.dmp

Download

memory/3324-297-0x00000000003F0000-0x0000000000473000-memory.dmp

Download

memory/3452-158-0x0000000000730000-0x00000000007B3000-memory.dmp

Download

memory/3452-166-0x0000000000730000-0x00000000007B3000-memory.dmp

Download

memory/3656-288-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/3656-282-0x0000000000A30000-0x0000000000AB3000-memory.dmp

Download

memory/3692-287-0x0000000000320000-0x00000000003A3000-memory.dmp

Download

memory/3692-293-0x0000000000320000-0x00000000003A3000-memory.dmp

Download

memory/3752-187-0x0000000000DA0000-0x0000000000E23000-memory.dmp

Download

memory/3752-195-0x0000000000DA0000-0x0000000000E23000-memory.dmp

Download

memory/3904-244-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/3904-238-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/3924-253-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/3924-259-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/3972-243-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/3972-249-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/4144-34-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/4144-26-0x0000000000B90000-0x0000000000C13000-memory.dmp

Download

memory/4232-48-0x0000000000700000-0x0000000000783000-memory.dmp

Download

memory/4232-56-0x0000000000700000-0x0000000000783000-memory.dmp

Download

memory/4292-277-0x0000000000070000-0x00000000000F3000-memory.dmp

Download

memory/4292-272-0x0000000000070000-0x00000000000F3000-memory.dmp

Download

memory/4760-14-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/4760-5-0x0000000000510000-0x0000000000593000-memory.dmp

Download

memory/4768-182-0x0000000000350000-0x00000000003D3000-memory.dmp

Download

memory/4768-188-0x0000000000350000-0x00000000003D3000-memory.dmp

Download

memory/4800-298-0x0000000000480000-0x0000000000503000-memory.dmp

Download

memory/4800-292-0x0000000000480000-0x0000000000503000-memory.dmp

Download

memory/4820-82-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

memory/4820-90-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

memory/4912-234-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/4912-228-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/5108-77-0x00000000003E0000-0x0000000000463000-memory.dmp

Download

memory/5108-69-0x00000000003E0000-0x0000000000463000-memory.dmp

Download

memory/5356-104-0x0000000000710000-0x0000000000793000-memory.dmp

Download

memory/5356-96-0x0000000000710000-0x0000000000793000-memory.dmp

Download

memory/5384-103-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/5384-110-0x00000000009A0000-0x0000000000A23000-memory.dmp

Download

memory/5544-68-0x0000000000A10000-0x0000000000A93000-memory.dmp

Download

memory/5544-62-0x0000000000A10000-0x0000000000A93000-memory.dmp

Download

memory/5668-151-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5668-159-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/5740-12-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/5740-20-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/5752-201-0x0000000000380000-0x0000000000403000-memory.dmp

Download

memory/5752-209-0x0000000000380000-0x0000000000403000-memory.dmp

Download

memory/5872-172-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/5872-179-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/5892-111-0x0000000000920000-0x00000000009A3000-memory.dmp

Download

memory/5892-180-0x0000000000920000-0x00000000009A3000-memory.dmp

Download

memory/5912-146-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/5912-138-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/6096-33-0x0000000000D00000-0x0000000000D83000-memory.dmp

Download

memory/6096-42-0x0000000000D00000-0x0000000000D83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads