520a7ca79d95b012cf41c38ed1baf59a0eec00de466685b4e9798421acc25fe4

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_3d8c972aa60c4087a77744e25376d23e_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260817-fe6f6sem31
SHA256 520a7ca79d95b012cf41c38ed1baf59a0eec00de466685b4e9798421acc25fe4
MD5 3d8c972aa60c4087a77744e25376d23e
SHA1 bbf57994ab5c4ea7f5e562e4f24e09093917fa77
SHA512 2169d66c6f294672fe5d0767cc40c6dda083a54f2d46348c49a1d7f363c0469f535a587f2b516da093b8c1e52396664a8d1bd79cbb8b24013bbecbc2f7f0b648
SSDEEP 49152:w/OJDTcb8DVCRnNGEADt7i+/yTukuFGNLrkBirx:EOHMNchrSiGdkBirx
TLSH
T16E06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3440	46B4.tmp
3604	47AE.tmp
4840	4BB5.tmp
1552	4F10.tmp
4752	50E5.tmp
3756	5385.tmp
4992	578C.tmp
2576	5AA9.tmp
5876	5DF5.tmp
4780	6112.tmp
4728	641F.tmp
1420	66BF.tmp
1188	698E.tmp
2928	6CD9.tmp
3636	6E60.tmp
4184	72A6.tmp
1432	7594.tmp
3460	76EB.tmp
1108	7B50.tmp
944	7E1F.tmp
2616	80CF.tmp
3096	835F.tmp
1872	866C.tmp
5924	894B.tmp
3048	8D04.tmp
2996	9021.tmp
6084	937C.tmp
2560	96A8.tmp
1556	9948.tmp
2416	9D30.tmp
5692	A00F.tmp
3828	A29F.tmp
1896	A53F.tmp
1708	A677.tmp
1740	A7B0.tmp
4980	A88B.tmp
2340	A985.tmp
2408	AAAD.tmp
5760	ABB7.tmp
4760	ACFF.tmp
1380	AE38.tmp
4128	AFAF.tmp
4844	B0F7.tmp
2160	B23F.tmp
2596	B3A6.tmp
4492	B4C0.tmp
4796	B5E8.tmp
4224	B721.tmp
5300	B82B.tmp
2484	B915.tmp
4508	BA0F.tmp
3700	BAEA.tmp
6136	BC13.tmp
4540	BD3B.tmp
3596	BDF7.tmp
1064	BEE1.tmp
6044	BFDB.tmp
4260	C0B6.tmp
2740	C191.tmp
3296	C25C.tmp
4584	C337.tmp
5076	C460.tmp
208	C52B.tmp
3448	C644.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54F7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	881D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BF4A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3257.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50DC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5E2A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F43A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A81.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBCB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE4B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F5E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13F7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DA4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C460.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCC5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F33B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AAAD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	255C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC0A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A66.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B21.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E35C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11FE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	463D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66D5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D901.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F62E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1260.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A1DF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA18.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CEAB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6E47.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4A7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C7F9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F36E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	320E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F1B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89B3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC5A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	706A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89DD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E41D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F67.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4BB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DE5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E517.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B3A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	686B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71A7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BE8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE02.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D63D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F2F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10DA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D0CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD85.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8B0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECF1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBD6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85F5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20D7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC17.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 3440	6120	2026-08-17_3d8c972aa60c4087a77744e25376d23e_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 3440 wrote to memory of 3604	3440	46B4.tmp	90
PID 3604 wrote to memory of 4840	3604	47AE.tmp	91
PID 4840 wrote to memory of 1552	4840	4BB5.tmp	92
PID 1552 wrote to memory of 4752	1552	4F10.tmp	93
PID 4752 wrote to memory of 3756	4752	50E5.tmp	94
PID 3756 wrote to memory of 4992	3756	5385.tmp	95
PID 4992 wrote to memory of 2576	4992	578C.tmp	96
PID 2576 wrote to memory of 5876	2576	5AA9.tmp	97
PID 5876 wrote to memory of 4780	5876	5DF5.tmp	98
PID 4780 wrote to memory of 4728	4780	6112.tmp	99
PID 4728 wrote to memory of 1420	4728	641F.tmp	100
PID 1420 wrote to memory of 1188	1420	66BF.tmp	101
PID 1188 wrote to memory of 2928	1188	698E.tmp	102
PID 2928 wrote to memory of 3636	2928	6CD9.tmp	103
PID 3636 wrote to memory of 4184	3636	6E60.tmp	104
PID 4184 wrote to memory of 1432	4184	72A6.tmp	105
PID 1432 wrote to memory of 3460	1432	7594.tmp	106
PID 3460 wrote to memory of 1108	3460	76EB.tmp	107
PID 1108 wrote to memory of 944	1108	7B50.tmp	108
PID 944 wrote to memory of 2616	944	7E1F.tmp	109
PID 2616 wrote to memory of 3096	2616	80CF.tmp	110
PID 3096 wrote to memory of 1872	3096	835F.tmp	111
PID 1872 wrote to memory of 5924	1872	866C.tmp	112
PID 5924 wrote to memory of 3048	5924	894B.tmp	113
PID 3048 wrote to memory of 2996	3048	8D04.tmp	114
PID 2996 wrote to memory of 6084	2996	9021.tmp	115
PID 6084 wrote to memory of 2560	6084	937C.tmp	116
PID 2560 wrote to memory of 1556	2560	96A8.tmp	117
PID 1556 wrote to memory of 2416	1556	9948.tmp	118
PID 2416 wrote to memory of 5692	2416	9D30.tmp	119
PID 5692 wrote to memory of 3828	5692	A00F.tmp	120
PID 3828 wrote to memory of 1896	3828	A29F.tmp	121
PID 1896 wrote to memory of 1708	1896	A53F.tmp	122
PID 1708 wrote to memory of 1740	1708	A677.tmp	123
PID 1740 wrote to memory of 4980	1740	A7B0.tmp	124
PID 4980 wrote to memory of 2340	4980	A88B.tmp	125
PID 2340 wrote to memory of 2408	2340	A985.tmp	126
PID 2408 wrote to memory of 5760	2408	AAAD.tmp	127
PID 5760 wrote to memory of 4760	5760	ABB7.tmp	128
PID 4760 wrote to memory of 1380	4760	ACFF.tmp	129
PID 1380 wrote to memory of 4128	1380	AE38.tmp	130
PID 4128 wrote to memory of 4844	4128	AFAF.tmp	131
PID 4844 wrote to memory of 2160	4844	B0F7.tmp	132
PID 2160 wrote to memory of 2596	2160	B23F.tmp	133
PID 2596 wrote to memory of 4492	2596	B3A6.tmp	134
PID 4492 wrote to memory of 4796	4492	B4C0.tmp	135
PID 4796 wrote to memory of 4224	4796	B5E8.tmp	136
PID 4224 wrote to memory of 5300	4224	B721.tmp	137
PID 5300 wrote to memory of 2484	5300	B82B.tmp	138
PID 2484 wrote to memory of 4508	2484	B915.tmp	139
PID 4508 wrote to memory of 3700	4508	BA0F.tmp	140
PID 3700 wrote to memory of 6136	3700	BAEA.tmp	141
PID 6136 wrote to memory of 4540	6136	BC13.tmp	142
PID 4540 wrote to memory of 3596	4540	BD3B.tmp	143
PID 3596 wrote to memory of 1064	3596	BDF7.tmp	144
PID 1064 wrote to memory of 6044	1064	BEE1.tmp	145
PID 6044 wrote to memory of 4260	6044	BFDB.tmp	146
PID 4260 wrote to memory of 2740	4260	C0B6.tmp	147
PID 2740 wrote to memory of 3296	2740	C191.tmp	148
PID 3296 wrote to memory of 4584	3296	C25C.tmp	149
PID 4584 wrote to memory of 5076	4584	C337.tmp	150
PID 5076 wrote to memory of 208	5076	C460.tmp	151
PID 208 wrote to memory of 3448	208	C52B.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-17_3d8c972aa60c4087a77744e25376d23e_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3d8c972aa60c4087a77744e25376d23e_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\46B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\46B4.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\47AE.tmp
    "C:\Users\Admin\AppData\Local\Temp\47AE.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\4BB5.tmp
      "C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\4F10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F10.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\50E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50E5.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\5385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5385.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\578C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\578C.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\5AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\5DF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\6112.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6112.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\641F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\641F.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\66BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66BF.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\698E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\698E.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\6CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\6E60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E60.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\72A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72A6.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\7594.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7594.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\76EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76EB.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\7B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B50.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\7E1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\80CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80CF.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\835F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\835F.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\866C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\866C.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\894B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\894B.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\8D04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D04.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\9021.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9021.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\937C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\937C.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\96A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96A8.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\9948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9948.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\9D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D30.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\A00F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A00F.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\A29F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A29F.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\A53F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A53F.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\A677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A677.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\A7B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\A88B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A88B.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\A985.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A985.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\AAAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\ABB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\ACFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\AE38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE38.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\AFAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\B0F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\B23F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B23F.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\B3A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\B4C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\B5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\B721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B721.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\B82B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B82B.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\B915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B915.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\BA0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\BAEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\BC13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC13.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\BD3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\BDF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\BEE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\BFDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\C0B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\C191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C191.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\C25C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C25C.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\C337.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C337.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\C460.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C460.tmp"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\C52B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C52B.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\C644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C644.tmp"
        65⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\C70F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70F.tmp"
        66⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\C7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\C8C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"
        68⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\C99F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C99F.tmp"
        69⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\CA8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"
        70⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\CB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB55.tmp"
        71⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\CBF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"
        72⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\CCBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"
        73⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\CD78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD78.tmp"
        74⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\CE33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE33.tmp"
        75⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\CF0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"
        76⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\CFC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"
        77⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\D085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D085.tmp"
        78⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\D17F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17F.tmp"
        79⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\D23A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D23A.tmp"
        80⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\D2F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"
        81⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\D3B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"
        82⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\D48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D48C.tmp"
        83⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\D557.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D557.tmp"
        84⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\D603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D603.tmp"
        85⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\D6BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"
        86⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\D78A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D78A.tmp"
        87⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\D865.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D865.tmp"
        88⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\D901.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D901.tmp"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\D9AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"
        90⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\DA68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA68.tmp"
        91⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\DB33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB33.tmp"
        92⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\DC0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"
        93⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\DCBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"
        94⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\DD85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD85.tmp"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\DE6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"
        96⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\DF2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"
        97⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\E006.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E006.tmp"
        98⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\E0C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"
        99⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\E17D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E17D.tmp"
        100⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\E257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E257.tmp"
        101⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\E332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E332.tmp"
        102⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\E41D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E41D.tmp"
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\E517.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E517.tmp"
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\E5F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"
        105⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\E6AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"
        106⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\E778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E778.tmp"
        107⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\E843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E843.tmp"
        108⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\E8EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"
        109⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\E9D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"
        110⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\EAB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"
        111⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\EB7F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"
        112⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\EC4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"
        113⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\ED54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED54.tmp"
        114⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\EE00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE00.tmp"
        115⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\EEEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"
        116⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\EFA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"
        117⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\F052.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F052.tmp"
        118⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\F12C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F12C.tmp"
        119⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\F1D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"
        120⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\F2B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2B3.tmp"
        121⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\F36E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F36E.tmp"
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\F43A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F43A.tmp"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\F543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F543.tmp"
        124⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\F62E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F62E.tmp"
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\F6F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"
        126⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\F7F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"
        127⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\F8BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"
        128⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\F999.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F999.tmp"
        129⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\FA54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA54.tmp"
        130⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\FB3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"
        131⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\FC0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\FCC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\FDBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"
        134⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\FEC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"
        135⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\FF84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF84.tmp"
        136⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40.tmp"
        137⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\11A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11A.tmp"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\1F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F5.tmp"
        139⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\2A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A1.tmp"
        140⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\38B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38B.tmp"
        141⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\437.tmp"
        142⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\4E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E3.tmp"
        143⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58F.tmp"
        144⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\699.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\699.tmp"
        145⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\745.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\745.tmp"
        146⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\82F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82F.tmp"
        147⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\8EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA.tmp"
        148⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\9B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B6.tmp"
        149⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\A90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A90.tmp"
        150⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\B5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5B.tmp"
        151⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\C46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C46.tmp"
        152⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\CF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF2.tmp"
        153⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\DBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBD.tmp"
        154⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E88.tmp"
        155⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\F43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F43.tmp"
        156⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\FFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFF.tmp"
        157⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\10DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10DA.tmp"
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\1186.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1186.tmp"
        159⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\1260.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1260.tmp"
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\132B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\132B.tmp"
        161⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\13F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13F7.tmp"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\14C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14C2.tmp"
        163⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\156E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\156E.tmp"
        164⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\1619.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1619.tmp"
        165⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\16D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16D5.tmp"
        166⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\1790.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1790.tmp"
        167⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\184C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\184C.tmp"
        168⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\1917.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1917.tmp"
        169⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\19D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19D3.tmp"
        170⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\1ABD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"
        171⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\1B78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B78.tmp"
        172⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\1C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C34.tmp"
        173⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\1CE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"
        174⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\1DAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"
        175⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\1E76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E76.tmp"
        176⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\1F41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F41.tmp"
        177⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\201C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\201C.tmp"
        178⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\20D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20D7.tmp"
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\21A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21A3.tmp"
        180⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\225E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\225E.tmp"
        181⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\230A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\230A.tmp"
        182⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\23F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F4.tmp"
        183⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\24B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24B0.tmp"
        184⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\255C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\255C.tmp"
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\2627.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2627.tmp"
        186⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\26E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26E2.tmp"
        187⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\27BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27BD.tmp"
        188⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\28A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28A7.tmp"
        189⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\2992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2992.tmp"
        190⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\2A4D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"
        191⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\2AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"
        192⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\2BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"
        193⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\2C8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"
        194⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\2D5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"
        195⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\2E16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E16.tmp"
        196⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\2ED2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ED2.tmp"
        197⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\2F8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"
        198⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\3077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3077.tmp"
        199⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\3152.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3152.tmp"
        200⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\320E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\320E.tmp"
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\32F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F8.tmp"
        202⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\33B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33B4.tmp"
        203⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\349E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\349E.tmp"
        204⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\353A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\353A.tmp"
        205⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\3615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3615.tmp"
        206⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\36E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36E0.tmp"
        207⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\378C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\378C.tmp"
        208⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\3838.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3838.tmp"
        209⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\3903.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3903.tmp"
        210⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\39CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39CE.tmp"
        211⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\3A8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"
        212⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\3B45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B45.tmp"
        213⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\3C20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C20.tmp"
        214⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\3CBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"
        215⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\3DB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"
        216⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\3E62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E62.tmp"
        217⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\3F1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"
        218⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\3FC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"
        219⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\4085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4085.tmp"
        220⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\4140.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4140.tmp"
        221⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\41EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41EC.tmp"
        222⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\42A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42A8.tmp"
        223⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\4344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4344.tmp"
        224⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\441F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\441F.tmp"
        225⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\44EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44EA.tmp"
        226⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\45A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45A5.tmp"
        227⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\4651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4651.tmp"
        228⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\46FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46FD.tmp"
        229⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\47A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47A9.tmp"
        230⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\4874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4874.tmp"
        231⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\4920.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4920.tmp"
        232⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\49DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49DB.tmp"
        233⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\4AC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"
        234⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\4B72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B72.tmp"
        235⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\4C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"
        236⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\4CE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"
        237⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\4DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\4E60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E60.tmp"
        239⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\4EFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"
        240⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\4FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"
        241⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\5083.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5083.tmp"
        242⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\513E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\513E.tmp"
        243⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\51EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51EA.tmp"
        244⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\52A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52A5.tmp"
        245⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\5380.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5380.tmp"
        246⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\542C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\542C.tmp"
        247⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\55A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55A3.tmp"
        249⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\564F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\564F.tmp"
        250⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\56EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56EB.tmp"
        251⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\57B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57B6.tmp"
        252⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\5862.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5862.tmp"
        253⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\58FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58FE.tmp"
        254⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\59BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59BA.tmp"
        255⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\5A66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A66.tmp"
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\5B21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B21.tmp"
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\5BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"
        258⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\5C89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C89.tmp"
        259⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\5D25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D25.tmp"
        260⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\5DE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DE0.tmp"
        261⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\5EAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EAC.tmp"
        262⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\5F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F67.tmp"
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\6023.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6023.tmp"
        264⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\60FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60FD.tmp"
        265⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\61A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61A9.tmp"
        266⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\6265.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6265.tmp"
        267⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\6330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6330.tmp"
        268⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\63EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63EB.tmp"
        269⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\64C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C6.tmp"
        270⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\6582.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6582.tmp"
        271⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\664D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\664D.tmp"
        272⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\6727.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6727.tmp"
        273⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\67C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67C4.tmp"
        274⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\6860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6860.tmp"
        275⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\693B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\693B.tmp"
        276⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\69E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69E7.tmp"
        277⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\6AA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"
        278⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\6B4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B4E.tmp"
        279⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\6C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C19.tmp"
        280⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\6CD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"
        281⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\6DBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"
        282⤵
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\6E9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E9A.tmp"
        283⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\6F65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F65.tmp"
        284⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\7001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7001.tmp"
        285⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\70EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70EB.tmp"
        286⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\71A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71A7.tmp"
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\7291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7291.tmp"
        288⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\734D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\734D.tmp"
        289⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\73F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73F9.tmp"
        290⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\74B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B4.tmp"
        291⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\7560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7560.tmp"
        292⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\762B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\762B.tmp"
        293⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\76E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76E7.tmp"
        294⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\77A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77A2.tmp"
        295⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\785E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\785E.tmp"
        296⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\7919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7919.tmp"
        297⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\79E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79E4.tmp"
        298⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\7A81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A81.tmp"
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\7B3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"
        300⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\7BE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BE8.tmp"
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\7CA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"
        302⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\7D4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"
        303⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\7E2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"
        304⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\7EF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"
        305⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\7FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FA1.tmp"
        306⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\806C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\806C.tmp"
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\8137.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8137.tmp"
        308⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\81E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81E3.tmp"
        309⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\8677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8677.tmp"
        310⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\8742.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8742.tmp"
        311⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\881D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\881D.tmp"
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\88F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88F8.tmp"
        313⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\89B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89B3.tmp"
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\8A6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"
        315⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\8B3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\8C15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C15.tmp"
        317⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\8CE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"
        318⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\8DBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"
        319⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\8E86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E86.tmp"
        320⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\8F31.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F31.tmp"
        321⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\8FFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"
        322⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\90F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90F7.tmp"
        323⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\91A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A2.tmp"
        324⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\928D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\928D.tmp"
        325⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\9348.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9348.tmp"
        326⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\93E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E5.tmp"
        327⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\94B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94B0.tmp"
        328⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\956B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\956B.tmp"
        329⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\9617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9617.tmp"
        330⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\96C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96C3.tmp"
        331⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\978E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\978E.tmp"
        332⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\9859.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9859.tmp"
        333⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\9924.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9924.tmp"
        334⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\99D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99D0.tmp"
        335⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\9A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"
        336⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\9B47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B47.tmp"
        337⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\9BF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BF3.tmp"
        338⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\9C9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C9F.tmp"
        339⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\9D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D5A.tmp"
        340⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\9DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"
        341⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\9EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EC2.tmp"
        342⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\9F7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F7D.tmp"
        343⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\A058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A058.tmp"
        344⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\A133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A133.tmp"
        345⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\A1DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\A28B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A28B.tmp"
        347⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\A346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A346.tmp"
        348⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\A3E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"
        349⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\A4CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"
        350⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\A598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A598.tmp"
        351⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\A653.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A653.tmp"
        352⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\A72E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A72E.tmp"
        353⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\A7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7F9.tmp"
        354⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\A8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8E4.tmp"
        355⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\A970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A970.tmp"
        356⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\AA3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"
        357⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\AB16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB16.tmp"
        358⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\ABB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABB2.tmp"
        359⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\AC4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"
        360⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\AD1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"
        361⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\ADC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADC6.tmp"
        362⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\AE81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE81.tmp"
        363⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\AF2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF2D.tmp"
        364⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\B008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B008.tmp"
        365⤵
        
        PID:52
        
        C:\Users\Admin\AppData\Local\Temp\B0F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0F2.tmp"
        366⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\B1BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1BD.tmp"
        367⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\B269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B269.tmp"
        368⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\B315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B315.tmp"
        369⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\B40F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B40F.tmp"
        370⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\B4BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4BB.tmp"
        371⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\B596.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B596.tmp"
        372⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\B651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B651.tmp"
        373⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\B71C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B71C.tmp"
        374⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\B7D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7D8.tmp"
        375⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\B8C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8C2.tmp"
        376⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\B97E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B97E.tmp"
        377⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\BA39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA39.tmp"
        378⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\BAF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAF5.tmp"
        379⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\BBCF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBCF.tmp"
        380⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\BC6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"
        381⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\BD37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD37.tmp"
        382⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\BE02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE02.tmp"
        383⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\BE8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"
        384⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\BF4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF4A.tmp"
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\BFE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFE6.tmp"
        386⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\C0A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0A2.tmp"
        387⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\C13E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C13E.tmp"
        388⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\C1F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1F9.tmp"
        389⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\C2A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2A5.tmp"
        390⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\C361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C361.tmp"
        391⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\C44B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C44B.tmp"
        392⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\C4F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4F7.tmp"
        393⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\C5E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5E1.tmp"
        394⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\C67E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C67E.tmp"
        395⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\C749.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C749.tmp"
        396⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\C804.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C804.tmp"
        397⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\C8B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8B0.tmp"
        398⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\C96C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C96C.tmp"
        399⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\CA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA18.tmp"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\CAF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAF2.tmp"
        401⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\CB9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB9E.tmp"
        402⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\CC5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC5A.tmp"
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\CD15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD15.tmp"
        404⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\CDD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDD1.tmp"
        405⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\CEAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEAB.tmp"
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\CF77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF77.tmp"
        407⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\D013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D013.tmp"
        408⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\D0CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0CE.tmp"
        409⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\D17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17A.tmp"
        410⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\D274.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D274.tmp"
        411⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\D320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D320.tmp"
        412⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\D40A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D40A.tmp"
        413⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\D4A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4A7.tmp"
        414⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\D581.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D581.tmp"
        415⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\D63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D63D.tmp"
        416⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\D6E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6E9.tmp"
        417⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\D795.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D795.tmp"
        418⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\D841.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D841.tmp"
        419⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\D8EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8EC.tmp"
        420⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\D9A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9A8.tmp"
        421⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\DA63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA63.tmp"
        422⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\DB1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB1F.tmp"
        423⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\DBCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBCB.tmp"
        424⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\DC86.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC86.tmp"
        425⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\DD71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD71.tmp"
        426⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\DE4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE4B.tmp"
        427⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\DF26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF26.tmp"
        428⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\DFF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFF1.tmp"
        429⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\E0BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0BC.tmp"
        430⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\E197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E197.tmp"
        431⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\E282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E282.tmp"
        432⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\E35C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E35C.tmp"
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\E485.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E485.tmp"
        434⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\E560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E560.tmp"
        435⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\E61B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E61B.tmp"
        436⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\E6F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6F6.tmp"
        437⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\E7A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7A2.tmp"
        438⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\E85E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E85E.tmp"
        439⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\E919.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E919.tmp"
        440⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\E9D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D5.tmp"
        441⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\EA90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA90.tmp"
        442⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\EB4C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB4C.tmp"
        443⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\EC17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC17.tmp"
        444⤵
        System Location Discovery: System Language Discovery
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\ECF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECF1.tmp"
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\EDAD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDAD.tmp"
        446⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\EE68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE68.tmp"
        447⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\EF34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF34.tmp"
        448⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\F00E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F00E.tmp"
        449⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\F118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F118.tmp"
        450⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\F1C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1C4.tmp"
        451⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\F28F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F28F.tmp"
        452⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\F33B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F33B.tmp"
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\F435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F435.tmp"
        454⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\F51F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F51F.tmp"
        455⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\F5FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5FA.tmp"
        456⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\F6D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6D5.tmp"
        457⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\F7A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7A0.tmp"
        458⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\F87B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F87B.tmp"
        459⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\F975.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F975.tmp"
        460⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\FA40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA40.tmp"
        461⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\FB1A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB1A.tmp"
        462⤵
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\FBD6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBD6.tmp"
        463⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\FCB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCB1.tmp"
        464⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\FD7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD7C.tmp"
        465⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\FE95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE95.tmp"
        466⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\FF60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF60.tmp"
        467⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B.tmp"
        468⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\125.tmp"
        469⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\1F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F0.tmp"
        470⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\2DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB.tmp"
        471⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\396.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\396.tmp"
        472⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\461.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\461.tmp"
        473⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\53C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53C.tmp"
        474⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\607.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\607.tmp"
        475⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\6F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F2.tmp"
        476⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\849.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\849.tmp"
        477⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\934.tmp"
        478⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\9EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF.tmp"
        479⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\ACA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACA.tmp"
        480⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B95.tmp"
        481⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C70.tmp"
        482⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5A.tmp"
        483⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E64.tmp"
        484⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\F5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5E.tmp"
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\1039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1039.tmp"
        486⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\1123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1123.tmp"
        487⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\11FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11FE.tmp"
        488⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        489⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\13C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13C3.tmp"
        490⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\149E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\149E.tmp"
        491⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\1588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1588.tmp"
        492⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\1663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1663.tmp"
        493⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\175D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\175D.tmp"
        494⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\1847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1847.tmp"
        495⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\1922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1922.tmp"
        496⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\1A0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A0C.tmp"
        497⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\1AF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AF7.tmp"
        498⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\1BB2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BB2.tmp"
        499⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\1C9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C9D.tmp"
        500⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\1D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D58.tmp"
        501⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\1E14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E14.tmp"
        502⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\1EDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EDF.tmp"
        503⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\1FAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FAA.tmp"
        504⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\20A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20A4.tmp"
        505⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\217F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\217F.tmp"
        506⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\222A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\222A.tmp"
        507⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\2315.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2315.tmp"
        508⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\241E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\241E.tmp"
        509⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\24F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24F9.tmp"
        510⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\25B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25B5.tmp"
        511⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\2661.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2661.tmp"
        512⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\271C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\271C.tmp"
        513⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\2806.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2806.tmp"
        514⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\28C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28C2.tmp"
        515⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\299D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\299D.tmp"
        516⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\2A58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A58.tmp"
        517⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\2B62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B62.tmp"
        518⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\2C1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C1D.tmp"
        519⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\2CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CD9.tmp"
        520⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\2DC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC3.tmp"
        521⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\2E5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E5F.tmp"
        522⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\2F1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F1B.tmp"
        523⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\2FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"
        524⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\30D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30D0.tmp"
        525⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\31CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31CA.tmp"
        526⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\3257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3257.tmp"
        527⤵
        System Location Discovery: System Language Discovery
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\3303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3303.tmp"
        528⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\33AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33AF.tmp"
        529⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\3499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3499.tmp"
        530⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\3535.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3535.tmp"
        531⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\3601.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3601.tmp"
        532⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\36BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36BC.tmp"
        533⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\3787.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3787.tmp"
        534⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\3843.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3843.tmp"
        535⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\391D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\391D.tmp"
        536⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\39D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39D9.tmp"
        537⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\3A94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A94.tmp"
        538⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\3B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B50.tmp"
        539⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\3C2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C2B.tmp"
        540⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\3CF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CF6.tmp"
        541⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\3DE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DE0.tmp"
        542⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\3E9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E9C.tmp"
        543⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\3F57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F57.tmp"
        544⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\4013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4013.tmp"
        545⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\40BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40BF.tmp"
        546⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\417A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417A.tmp"
        547⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\4255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4255.tmp"
        548⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\4320.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4320.tmp"
        549⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\43FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43FB.tmp"
        550⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\4497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4497.tmp"
        551⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\4562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4562.tmp"
        552⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\463D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\463D.tmp"
        553⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\46F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46F8.tmp"
        554⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\47B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47B4.tmp"
        555⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\488F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\488F.tmp"
        556⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\492B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\492B.tmp"
        557⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\4A06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A06.tmp"
        558⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\4AE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AE0.tmp"
        559⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\4B7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B7D.tmp"
        560⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\4C19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C19.tmp"
        561⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\4CF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CF4.tmp"
        562⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\4DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DEE.tmp"
        563⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\4E8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E8A.tmp"
        564⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\4F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F74.tmp"
        565⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\5030.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5030.tmp"
        566⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\50DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50DC.tmp"
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\51A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51A7.tmp"
        568⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\5243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5243.tmp"
        569⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\52FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52FE.tmp"
        570⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\53CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53CA.tmp"
        571⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\54D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54D3.tmp"
        572⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\559E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\559E.tmp"
        573⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\565A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\565A.tmp"
        574⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\5706.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5706.tmp"
        575⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\57E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57E0.tmp"
        576⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\588C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\588C.tmp"
        577⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\5948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5948.tmp"
        578⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\5A13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A13.tmp"
        579⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\5ADE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ADE.tmp"
        580⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\5BB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BB9.tmp"
        581⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\5CC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CC2.tmp"
        582⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\5D7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D7E.tmp"
        583⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\5E2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E2A.tmp"
        584⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\5F05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F05.tmp"
        585⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\5FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FEF.tmp"
        586⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\60BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60BA.tmp"
        587⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\6185.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6185.tmp"
        588⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\6241.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6241.tmp"
        589⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\630C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\630C.tmp"
        590⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\63D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\63D7.tmp"
        591⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\64A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64A2.tmp"
        592⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\655E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\655E.tmp"
        593⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\6619.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6619.tmp"
        594⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\66D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66D5.tmp"
        595⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\67AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67AF.tmp"
        596⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\686B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\686B.tmp"
        597⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\6936.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6936.tmp"
        598⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\69F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69F1.tmp"
        599⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\6A8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A8E.tmp"
        600⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\6B3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3A.tmp"
        601⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\6C05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C05.tmp"
        602⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\6CD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CD0.tmp"
        603⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\6D9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D9B.tmp"
        604⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\6E47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E47.tmp"
        605⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\6F02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F02.tmp"
        606⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\6FAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FAE.tmp"
        607⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\706A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\706A.tmp"
        608⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\7125.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7125.tmp"
        609⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\71E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71E1.tmp"
        610⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\72AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72AC.tmp"
        611⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\7358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7358.tmp"
        612⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\7413.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7413.tmp"
        613⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\74CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74CF.tmp"
        614⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\757B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\757B.tmp"
        615⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\7646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7646.tmp"
        616⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\76F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76F2.tmp"
        617⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\77DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77DC.tmp"
        618⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\7878.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7878.tmp"
        619⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\7943.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7943.tmp"
        620⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\79FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79FF.tmp"
        621⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\7AAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AAB.tmp"
        622⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\7B66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B66.tmp"
        623⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\7C12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C12.tmp"
        624⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\7CDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"
        625⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\7DA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"
        626⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\7E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E64.tmp"
        627⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\7F2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F2F.tmp"
        628⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\7FFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FFA.tmp"
        629⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\80A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80A6.tmp"
        630⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\8171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8171.tmp"
        631⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\821D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\821D.tmp"
        632⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\82F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82F8.tmp"
        633⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\83B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83B3.tmp"
        634⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\849E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\849E.tmp"
        635⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\853A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\853A.tmp"
        636⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\85F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85F5.tmp"
        637⤵
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\86A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86A1.tmp"
        638⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\877C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\877C.tmp"
        639⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\8866.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8866.tmp"
        640⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\8922.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8922.tmp"
        641⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\89DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89DD.tmp"
        642⤵
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\8A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A99.tmp"
        643⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\8B74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B74.tmp"
        644⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\8C2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C2F.tmp"
        645⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\8D0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D0A.tmp"
        646⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\8DE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DE5.tmp"
        647⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\8EA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA0.tmp"
        648⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\8F7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F7B.tmp"
        649⤵
        
        PID:6356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\46B4.tmp
Size 3.6MB
SHA256 e0a98583e5a3703566169871a5cef3e757476dd82aa5983a688bb94a5f3e64e8
MD5 2425e62b5cfe49d24dbf714920b60228
SHA1 5dbc402f913663bd42197791398e04c8f486c686
SHA512 cb263ced73ce158a7c1980ba4d2e248c78dd577777c22eb161501d44bf348e5b2096fda9ac6ff740c87b17ba693a0d358fc3af4866594f89081e2adc4f72d2d8
SSDEEP 49152:w/OJDQtONGEADt7i+/yTukuFGNLrkBirx:EOigchrSiGdkBirx
TLSH
T18B06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\47AE.tmp
Size 3.6MB
SHA256 7b7e4feca2775e065f85bbe5e32aa81e1980662ce9762ed49558ec17b87e7333
MD5 0b4280227d7bba0d34e98884402d46fe
SHA1 7cc7955f0430735bcd06f1f4cfefa85fe047aecb
SHA512 3bb6c09115e0cb78f2d15837bd9a092906c5f16b404398cc7b7972549d18635affcdce371b583bd9d131e7e9f325a1aed6077c44acd36997d1d177123b32f6d9
SSDEEP 49152:w/OJD+QHNGEADt7i+/yTukuFGNLrkBirx:EOgQHchrSiGdkBirx
TLSH
T10C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\4BB5.tmp
Size 3.6MB
SHA256 b262cd04f11043db2cc53053508943f946a1b9473f25e0eaec639691b712bd14
MD5 bcac08306123bfbe6088ca7aead65858
SHA1 91f223a9a1af7d5c5e05db7068277596cfdd9148
SHA512 bd49f77e6eb1a6b34206b7a04fd3989ef6a759dceaaa82b1e54f5be163dbcb923f081a7f6240cdc003ac472000aa5f0780083a5a1cf5da37c2e208c2d1423fda
SSDEEP 49152:w/OJDYiokNGEADt7i+/yTukuFGNLrkBirx:EOOiokchrSiGdkBirx
TLSH
T10006831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4F10.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F10.tmp
Size 3.6MB
SHA256 828c2ad500a8ed4735276899960c6d6e6c5928eb6f8445a0c09fa8d2b0ac490b
MD5 d32b9ec6d8d3af3008f897aad21bcd9a
SHA1 c108c5439502ed6b868c4d4287c9f28588e2cbd6
SHA512 292b10f382a878aca9fca730f8df7bc8ae829f928c8d14b996b73e6ecd04dd05c23e86b323e1ade63667f8334f2a1f546fbfb37b47756a88af6277eb7b07f603
SSDEEP 49152:w/OJDsO0wNGEADt7i+/yTukuFGNLrkBirx:EO+OFchrSiGdkBirx
TLSH
T19E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\50E5.tmp
Size 3.6MB
SHA256 04cedab8462494e8c590c80ce0dbeb13d9f4e826ae13944b7a7eddc5c532b290
MD5 e3a2a66615c71ec27b0d5182ad2e73cf
SHA1 c0ff8eb9026e8d5fcb8f0aab75a78f10ae1f3974
SHA512 2c6555f7191aa186fa17cebab7fcc33b58ee99772f1b461910fddefaf9f014e4eabcad90f95e5a91f3dd6eebcb9c84a2ec4aa2b8ba951b3e0f0a73b76c098c6f
SSDEEP 49152:w/OJDztPBoNGEADt7i+/yTukuFGNLrkBirx:EOZwchrSiGdkBirx
TLSH
T1D806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5385.tmp

Path C:\Users\Admin\AppData\Local\Temp\5385.tmp
Size 3.6MB
SHA256 ce559db292a154c1be15f8bc37e6951fad41f3dea59903f0e9c49ad16c48f158
MD5 049b92041b91d880073ddeb5f02053d3
SHA1 2ea457e94bf78691fb69c3a1494fcf813e98bb90
SHA512 388b91c88de3aa45e3b3002e7756737a56228861acd2f4686988cf3f8e2362046a5f4f5de9815e47783eda74b6c627f461d0f29647dd7bce180988c7ba7778e6
SSDEEP 49152:w/OJDWDXnNGEADt7i+/yTukuFGNLrkBirx:EOM3chrSiGdkBirx
TLSH
T1D806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

578C.tmp

Path C:\Users\Admin\AppData\Local\Temp\578C.tmp
Size 3.6MB
SHA256 43e70b44892dd5b160a10f827562e487bc012a5c6fa394dfe7c88aca58bed33e
MD5 b8e3d2987c6a62f95675192b8a0c8715
SHA1 47419faba1a6f512b1aa34e1a7ef9719b0ee944d
SHA512 1185d7c26015e45afe225535cf61ff1fba388c1e20a023910e7555327b019fc99b23c1d816c9a29df0074e131655111941fab2a6c1d50bf977233f0cfae6610a
SSDEEP 49152:w/OJDXQlVvaDbNGEADt7i+/yTukuFGNLrkBirx:EOy38chrSiGdkBirx
TLSH
T1E806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AA9.tmp

Path C:\Users\Admin\AppData\Local\Temp\5AA9.tmp
Size 3.6MB
SHA256 34e83c308c5f6b2d125bdedcbf699542010ea0c69bb18508703ecfc26f22138c
MD5 f73dd4c40e79481b2af1e8c3b1434bd6
SHA1 672a980373014e11c7be188f6476e26308f6aee0
SHA512 4986d5678e79bae3246c45e20d500505319f167b1f7bc60181db0d76f2681313424083f15ee3081e4575252ecf126a9e6201e7bb0d238e4c1ff5b46004b03e76
SSDEEP 49152:w/OJDjmlE+QNAENGEADt7i+/yTukuFGNLrkBirx:EOclEpNXchrSiGdkBirx
TLSH
T18E06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5DF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\5DF5.tmp
Size 3.6MB
SHA256 7b6ea8a7cf24bf258f0aa1097869c6cafc23dc702d3aa0fecf6988dabfdf253e
MD5 eae78b3e78cf9aa7b088d1471953a118
SHA1 f5fdfb57fb24676672db99f2dbce6f3e42588179
SHA512 e227192d616f463ae8554e2e251ebdbf9d14323da075b348739c1f860f755a9f4f5e691101d742737318531730accfa0f213bfabd92772b58b5d1605e62900ed
SSDEEP 49152:w/OJDTfOIWcZNGEADt7i+/yTukuFGNLrkBirx:EOUqZchrSiGdkBirx
TLSH
T17C06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6112.tmp

Path C:\Users\Admin\AppData\Local\Temp\6112.tmp
Size 3.6MB
SHA256 ea01cf5efd41358cc2e3753537b6e1abd7f48f7f460d46d36e0d804516ea0495
MD5 1d7c81ac47f9fccf399235f3f8bbbf3e
SHA1 533f23e9519bd316ffa91202f96e84374d8e3b68
SHA512 f5d0bb4faddd2d6f4da0eed117b07c608bb7c803804749c8a7f8e2407ab2743b2185fc3a3888a72443db3f74d4b87b0e00da75c6c4618fa9bdbb27da6b17af09
SSDEEP 49152:w/OJDeW134/NGEADt7i+/yTukuFGNLrkBirx:EOMTchrSiGdkBirx
TLSH
T14C06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

641F.tmp

Path C:\Users\Admin\AppData\Local\Temp\641F.tmp
Size 3.6MB
SHA256 132ec25c22ca8ef88a7ff57a69d9f1b182e4c92cec97c7ee36778ba7d3b71513
MD5 88632545e240d9e255b1dd5ef2d9875a
SHA1 0bc8e017ba04c7cc083968b2bc3d5ce738e45ed8
SHA512 43e399744b4d3249ad189846ca4ed14c0847be30e56b5153dd8edd445848b01d1b268493e80e356238a86c32ce9b7678b59a1c84ef17c64b4ebb8cd14a38ad73
SSDEEP 49152:w/OJDYfAlYkpjiskqCONGEADt7i+/yTukuFGNLrkBirx:EOQAlYk1kqCOchrSiGdkBirx
TLSH
T1A806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\66BF.tmp
Size 3.6MB
SHA256 2cf7beb361afc17f3afef2121c8078d5ae2b691e38c85252a602047e5439be17
MD5 4a089fc44a5f316cf448b581317b8c00
SHA1 d409eeb379cf54d713b500308ddb70a1ad6da67d
SHA512 bac1e82a515305af273bf0f0f27d11628ed283d4a66dc1f3583d4258a3749681716cf49c2bc94cf890b76540656c375b2a898cb8b6ecc1c36bcc3a59f41dd437
SSDEEP 49152:w/OJD2pRN+NGEADt7i+/yTukuFGNLrkBirx:EO0pRN+chrSiGdkBirx
TLSH
T12206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698E.tmp

Path C:\Users\Admin\AppData\Local\Temp\698E.tmp
Size 3.6MB
SHA256 c40d461e9cf32da0ffcd0e06fb27fa9c3783187c18905528804842c4042f75db
MD5 6f04501110125aef356f6a0503f6ea59
SHA1 d41c6a77fda9fead13c370531c321343411c879b
SHA512 3fc0cb07fc9e94f12e7f9cb3343e6a4580a21d14ceb98019ad5a8f49710373b89c62aefab99196705bc541a60f7f2ff4f55b03d1f272f1a3d29978eb76bdfa44
SSDEEP 49152:w/OJDH2B0PV6NGEADt7i+/yTukuFGNLrkBirx:EOJPV6chrSiGdkBirx
TLSH
T10906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6CD9.tmp

Path C:\Users\Admin\AppData\Local\Temp\6CD9.tmp
Size 3.6MB
SHA256 e7a23b80d1c685845da0d9970a85349264e1bc2930f28fd7b030522e2dd903e7
MD5 e2d47989189f1c5d6fcccc18077c8be1
SHA1 7942a85b022dfe853c516a905960ca7ec2ef8cbd
SHA512 5737add5e4753913bcc520c8d1104bbd08a8c21255250a0502ddd284825d95288bf56602e9278954538af3160920f07795e9f89fca983526c5f9e8761ee8f111
SSDEEP 49152:w/OJD0R45gY4gjNGEADt7i+/yTukuFGNLrkBirx:EO24nrjchrSiGdkBirx
TLSH
T1C106931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6E60.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E60.tmp
Size 3.6MB
SHA256 0065adcb4360ff712a54ffa8861891cc14ed08347950d63eadb8edbc80c02263
MD5 49ca88469842e831649f582691e435d1
SHA1 1bc08c825544d053b0c1d63266f4946455fb17b1
SHA512 fbefa2a531188aa366a483536363a941d0b05bf664affdfeaa8e1d09e7567bd37a1d0818f4b8712f1cb12a0f8a79bc24d334aaa164de9181aea81bfdef949445
SSDEEP 49152:w/OJD4WxGCNGEADt7i+/yTukuFGNLrkBirx:EOWWxGCchrSiGdkBirx
TLSH
T14906831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\72A6.tmp
Size 3.6MB
SHA256 beb34b6f03ca7de9ca1f0a9e78af4f4afe7e66d4f2bcfc60201f4b3ae092bc3e
MD5 eca60ac9c8fc1bf4a156c468756ad1e4
SHA1 b292468de352556a240444271fa0b93175dee79e
SHA512 bb85a1b3690e18aae704cbbf85751491a552a5261d898fd6f81b8c4592399c4e9a1aa0fcde471c037901edc6bc095fe656ba3834855521838d2b25e7702d3248
SSDEEP 49152:w/OJDV1erNGEADt7i+/yTukuFGNLrkBirx:EOUchrSiGdkBirx
TLSH
T17A06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7594.tmp

Path C:\Users\Admin\AppData\Local\Temp\7594.tmp
Size 3.6MB
SHA256 deed4e94f64b109e9197b4090e81c19ede9a9d0c65595174e4246487635ca71d
MD5 abc6343a03f3cef72078359133bb2806
SHA1 e75fbcada3f587ba7f0ad3e09d5de678e1d1fc46
SHA512 86457281be36c75b430ab4271552cc86a98953cc565ded571bf5b1364331571b6914de8e9ac9a56ea038866eefe6eca68088d7fdbe42b50cbcfd711296a7e786
SSDEEP 49152:w/OJDs3PoYNGEADt7i+/yTukuFGNLrkBirx:EO+oYchrSiGdkBirx
TLSH
T18106831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\76EB.tmp
Size 3.6MB
SHA256 99fb9831388da705fd8236af08d65e0fbbdbe5cda4e2d2fc92540fd2325f134a
MD5 4670a4520830754d7c59ec2991ee3b31
SHA1 3a8a409725aa0b443d88d0628180e7b6eab58f1a
SHA512 7430c0e19512a9818ac07c4f49c7c697fd8ad93401b892ae5641bc9ddc8b4f10b89efc80c43b84aa6f1aac06eca346a978955c00c36dc104cd5abeddd1b6f7a1
SSDEEP 49152:w/OJDc1A8JDNGEADt7i+/yTukuFGNLrkBirx:EOqhDchrSiGdkBirx
TLSH
T1BA06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B50.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B50.tmp
Size 3.6MB
SHA256 a456709f9f0e26fd49b0e51fec34472b5462ce1081688d9f34e5111c49bad77c
MD5 775605a3a846d3bc55cae2f8d95cda89
SHA1 9faa8f2d27a67e64997146eb1563741f878a877e
SHA512 b160d2de7969275b6f23211d689ceacb0b30b8f485d1cdc0ecfc30935ca21b1f90ca3a29566164f5388101c5da00f8273791a9bc47f8b2c904561c7a843964b3
SSDEEP 49152:w/OJDnIJBNGEADt7i+/yTukuFGNLrkBirx:EOtIJBchrSiGdkBirx
TLSH
T1BA06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7E1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E1F.tmp
Size 3.6MB
SHA256 cefda4e4c585dcb6b6fa9cace1fba54146f4d12a2328278bbc1612f5ea87c989
MD5 d8b2c4e40b1c8cd1396b27f2eed4e35b
SHA1 b1046acfca89fcd05085c9ab93b7037b1b383ba3
SHA512 3a974ed001395163484ba69ece4a219a6c3a14a91ae33d154ab02ece2d0335295de110804084cbc4dba3d7e43a79d95b16efaf7cfcaf6d249199cd67853e82f1
SSDEEP 49152:w/OJD9En+9NGEADt7i+/yTukuFGNLrkBirx:EOPE4chrSiGdkBirx
TLSH
T12506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\80CF.tmp
Size 3.6MB
SHA256 8db6cd1dc6cf2ac23c7817e6f29a01aae75d00c19c0e8467118172831dd57959
MD5 9be407b74bd7a42db6eb34d38ab75e72
SHA1 8203d8d0b69dff06487a52c6135afafd4f167ac6
SHA512 949b6bcc1b9731a2517655b560d4c4460813e445cfc12a672439166495ab5397feee0b921a70ad7c103c5b5a5a723563617dbb5cd52382a1fe74beb20da69864
SSDEEP 49152:w/OJDgb0w+2uOhzNGEADt7i+/yTukuFGNLrkBirx:EO64wNuOhzchrSiGdkBirx
TLSH
T11206931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

835F.tmp

Path C:\Users\Admin\AppData\Local\Temp\835F.tmp
Size 3.6MB
SHA256 cba0ff7d47311432ee93a0a3f1f647053e3ae6ce47701e1a2b85c1ba895ea8b2
MD5 21a22c099bb577be66eae10ed6cf23a7
SHA1 534809d82e76734d8c41ee477f5dc9cab50a58ac
SHA512 b6f49fd811a2596994a2d3d4324a03d1cd267fc5257a18b9090c9621f1e419b43baee96810a6ca4b11e59f196498647b3e751ec76cdb574bc77d87ef6670b609
SSDEEP 49152:w/OJD+MnDqT6NGEADt7i+/yTukuFGNLrkBirx:EONDqechrSiGdkBirx
TLSH
T19306931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

866C.tmp

Path C:\Users\Admin\AppData\Local\Temp\866C.tmp
Size 3.6MB
SHA256 d0537aede8bf7b2724013e13fa7e9fc05fd28ee31c732f30b3311e5dd2af321b
MD5 fa528cfab464d7062de04b21c4fd251b
SHA1 41c3c9db24cff7b27ff15a054a9f6ea11d0e63fb
SHA512 1452654d9984275454fe6a27b1bfc555674b30af9d9b4672a4a91f92f5281d2557e6d0c6d6d1888c0955c9de9a7eaeafc8c7b60c45c156ee46b6b413de172ff2
SSDEEP 49152:w/OJD2eRhNGEADt7i+/yTukuFGNLrkBirx:EORchrSiGdkBirx
TLSH
T14B06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

894B.tmp

Path C:\Users\Admin\AppData\Local\Temp\894B.tmp
Size 3.6MB
SHA256 298eb04a2991fbe3c4c72b15b6196310882490e2109fe5abab30c77121e1b733
MD5 d63a62f0335c218daebcccf99990a802
SHA1 4f3371811a0576c09bb4569ce6d6039967b7b4fc
SHA512 8c1e9637646a3a6d126fac5c087151b3ba7ae905a05fe598473d82a67ee81b9300433c232fe8527ca496a43f6680b9c679e9b968aed6207055dafc97ae08dffa
SSDEEP 49152:w/OJDZ77njSXNGEADt7i+/yTukuFGNLrkBirx:EOX7iXchrSiGdkBirx
TLSH
T1A506831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8D04.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D04.tmp
Size 3.6MB
SHA256 ae9d2d72521dbcc5dbca7e371dd9f294568850beeea7baddcce9694818d6708c
MD5 1d7f097e41fc41746cbd9775c238696e
SHA1 6ab3ef8b356c5b8022e89852c12e2518abe80c38
SHA512 2fb380d8a3eb0557e2d99b49a5c1177ae9d2e4055bc8d9fc57ef656406cec6094a0589f6a2d7be8f968f3d4519fd37d1730d6c149e8c7d3342cd84171b1514d3
SSDEEP 49152:w/OJDStGKNGEADt7i+/yTukuFGNLrkBirx:EO0tDchrSiGdkBirx
TLSH
T1F406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9021.tmp

Path C:\Users\Admin\AppData\Local\Temp\9021.tmp
Size 3.6MB
SHA256 4f7eb26ea3d6f207e21216ad129cd15b7b241a1ca959b8799d6e59ea809f6c2c
MD5 5b3deea0f0a10a7c2f19f601b1ec4c3f
SHA1 b635d363f53a5d4e9697d3b6f84dd240f3a44079
SHA512 9b60db057127aafccc2b4cd41454df2a6402fd208443e98a26b10ef404a939deb2bf48190626c1602592eaa2b9d3b8453ba332135c819d7bf96048ba8785a451
SSDEEP 49152:w/OJDnCWV3X4NGEADt7i+/yTukuFGNLrkBirx:EO8WVn4chrSiGdkBirx
TLSH
T1EB06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

937C.tmp

Path C:\Users\Admin\AppData\Local\Temp\937C.tmp
Size 3.6MB
SHA256 7e2482bee73bf0e2c913fdc5cff67ce08a0677b888ab14fb7a95ce98d3835df1
MD5 c9755d8828197051774f77d53e8a2a74
SHA1 8e76a418d093a1246f29aa5c43acf8273bef519b
SHA512 9b1cae3bfd5ba2335a40713bb58c47d5f44c4be21bc7b39bb60fcffd8de6c2f435a89becc75b436e6a7aa98a4f20016b2f2f1702315b1c5a2c9839ceff06bac4
SSDEEP 49152:w/OJD/e9xNGEADt7i+/yTukuFGNLrkBirx:EONychrSiGdkBirx
TLSH
T13D06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\96A8.tmp
Size 3.6MB
SHA256 078a25411021d953087ced0cffc109c66dc71a5591d53b59786dbd84ae41765e
MD5 5ac099926f7350eb75177b1987a2bf68
SHA1 06b27617c802629c97c92f88401d1ede225367e3
SHA512 1f73cf935cbf13bdc899dbce0e985fc0b671988d5eb812065fb2ecdc39cac9643e8dcbdbef7ae26192123025bc1673a9b7e54a0374d40978b102c4cf70039afe
SSDEEP 49152:w/OJDL9tLgTNGEADt7i+/yTukuFGNLrkBirx:EO2chrSiGdkBirx
TLSH
T16906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9948.tmp

Path C:\Users\Admin\AppData\Local\Temp\9948.tmp
Size 3.6MB
SHA256 7dd5067687d7aadb024cf27f958fb0b1cb1b21d1dd33654b9b8b731b21aff9cc
MD5 030ab5429827d0985ad1e3751f8b692c
SHA1 07ad15fe1f3544e49ff69461fba1a1d348f131e1
SHA512 882b39d9a2c13d44ed07e924fc2f3d0f5a6f56ef69608e406cdd257cc391d492d169658643e2f48694cccfa3ae778053628ade2dd77b7eb81192f3862be40ae8
SSDEEP 49152:w/OJD/Lu7rnNGEADt7i+/yTukuFGNLrkBirx:EOBLOzchrSiGdkBirx
TLSH
T16506931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9D30.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D30.tmp
Size 3.6MB
SHA256 6d72cc5f3d029bd938dbd7f1056cd8d9450e654dca9dd05092220b0fcfa70119
MD5 735aca1ca80e8de15f16e23dd8c00cc1
SHA1 2897ad9505a950acb9647afc46e0bf52f725e12b
SHA512 b7f6d6b1bbf8df894d16c238130290bdbe676480b3b9d7c8471e430d86855d44d9d18065f83094a16821a5d255e5c6a79c633665c6bf9aabd5add2d035ba0e64
SSDEEP 49152:w/OJDamhNGEADt7i+/yTukuFGNLrkBirx:EOgmhchrSiGdkBirx
TLSH
T17306931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A00F.tmp

Path C:\Users\Admin\AppData\Local\Temp\A00F.tmp
Size 3.6MB
SHA256 1a4f78f9a07742e710cb402a0dc53367b481ba62245660d18775f65e2fbc7f6e
MD5 0b5339c4342988f4eb45018539af74cd
SHA1 bc73d706c21429186f1e14beda2f3f8f5b57e557
SHA512 e8c6d4c427a3e71ec6767d535859b2f6cf2f003ae86640a82788a424ef9ceace10745540c87d612aa7232de7eb2d5bee40d304fd7aaa52c6bc3b7f3fe9c9b95d
SSDEEP 49152:w/OJDI12lIptNGEADt7i+/yTukuFGNLrkBirx:EOajfchrSiGdkBirx
TLSH
T14806931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A29F.tmp

Path C:\Users\Admin\AppData\Local\Temp\A29F.tmp
Size 3.6MB
SHA256 4b88e8e328ffb0ebf58594e93c0f409c223f298e679aca06ffeb60f1d05e1112
MD5 07d5f32c4de3746c657900469de7188f
SHA1 9c72630e363f0d54f4c408cdd12b35a79c47bcc2
SHA512 3a61aad8ba7b61caae453a488152eb7658b3b8856c29fa38dcb9658d995e80c8cec40a173cde0fffde5f9e0761b9ec460f0074c5b055c8564e663ad874eb3e39
SSDEEP 49152:w/OJDqDJKlNGEADt7i+/yTukuFGNLrkBirx:EOcochrSiGdkBirx
TLSH
T14E06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-139-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/944-146-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/1108-140-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/1108-131-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/1188-96-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/1188-89-0x00000000005A0000-0x0000000000623000-memory.dmp

Download

memory/1380-267-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/1380-273-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/1420-82-0x0000000000120000-0x00000000001A3000-memory.dmp

Download

memory/1420-90-0x0000000000120000-0x00000000001A3000-memory.dmp

Download

memory/1432-117-0x0000000000C50000-0x0000000000CD3000-memory.dmp

Download

memory/1432-125-0x0000000000C50000-0x0000000000CD3000-memory.dmp

Download

memory/1552-26-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/1552-35-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/1556-208-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/1556-201-0x0000000000370000-0x00000000003F3000-memory.dmp

Download

memory/1708-233-0x0000000000450000-0x00000000004D3000-memory.dmp

Download

memory/1740-238-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1740-243-0x0000000000D80000-0x0000000000E03000-memory.dmp

Download

memory/1872-160-0x0000000000420000-0x00000000004A3000-memory.dmp

Download

memory/1872-167-0x0000000000420000-0x00000000004A3000-memory.dmp

Download

memory/1896-228-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/1896-234-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/2160-283-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/2160-288-0x0000000000720000-0x00000000007A3000-memory.dmp

Download

memory/2340-247-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/2340-253-0x0000000000C60000-0x0000000000CE3000-memory.dmp

Download

memory/2408-258-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/2408-252-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/2416-210-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/2416-215-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/2560-203-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/2560-194-0x0000000000C30000-0x0000000000CB3000-memory.dmp

Download

memory/2576-54-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/2576-61-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/2596-287-0x0000000000CF0000-0x0000000000D73000-memory.dmp

Download

memory/2596-292-0x0000000000CF0000-0x0000000000D73000-memory.dmp

Download

memory/2616-153-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/2616-145-0x00000000001D0000-0x0000000000253000-memory.dmp

Download

memory/2928-105-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2928-97-0x0000000000460000-0x00000000004E3000-memory.dmp

Download

memory/2996-180-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/2996-188-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/3048-182-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3048-174-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3096-152-0x00000000009F0000-0x0000000000A73000-memory.dmp

Download

memory/3096-159-0x00000000009F0000-0x0000000000A73000-memory.dmp

Download

memory/3440-6-0x00000000008F0000-0x0000000000973000-memory.dmp

Download

memory/3440-14-0x00000000008F0000-0x0000000000973000-memory.dmp

Download

memory/3460-132-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/3460-126-0x0000000000EA0000-0x0000000000F23000-memory.dmp

Download

memory/3604-20-0x00000000005F0000-0x0000000000673000-memory.dmp

Download

memory/3604-12-0x00000000005F0000-0x0000000000673000-memory.dmp

Download

memory/3636-103-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/3636-111-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/3756-48-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/3756-40-0x0000000000770000-0x00000000007F3000-memory.dmp

Download

memory/3828-222-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/3828-229-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/4128-278-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/4128-272-0x0000000000900000-0x0000000000983000-memory.dmp

Download

memory/4184-110-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/4184-118-0x00000000005B0000-0x0000000000633000-memory.dmp

Download

memory/4224-302-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/4492-293-0x0000000000080000-0x0000000000103000-memory.dmp

Download

memory/4492-298-0x0000000000080000-0x0000000000103000-memory.dmp

Download

memory/4728-83-0x00000000000C0000-0x0000000000143000-memory.dmp

Download

memory/4728-75-0x00000000000C0000-0x0000000000143000-memory.dmp

Download

memory/4752-33-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/4752-42-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/4760-262-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/4760-268-0x0000000000FC0000-0x0000000001043000-memory.dmp

Download

memory/4780-76-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4780-69-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/4796-303-0x0000000000EC0000-0x0000000000F43000-memory.dmp

Download

memory/4796-297-0x0000000000EC0000-0x0000000000F43000-memory.dmp

Download

memory/4840-28-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/4840-19-0x00000000006F0000-0x0000000000773000-memory.dmp

Download

memory/4844-282-0x00000000000F0000-0x0000000000173000-memory.dmp

Download

memory/4844-277-0x00000000000F0000-0x0000000000173000-memory.dmp

Download

memory/4980-242-0x0000000000D60000-0x0000000000DE3000-memory.dmp

Download

memory/4980-248-0x0000000000D60000-0x0000000000DE3000-memory.dmp

Download

memory/4992-47-0x00000000002A0000-0x0000000000323000-memory.dmp

Download

memory/4992-55-0x00000000002A0000-0x0000000000323000-memory.dmp

Download

memory/5692-223-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/5692-216-0x0000000000E10000-0x0000000000E93000-memory.dmp

Download

memory/5760-257-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/5760-263-0x0000000000F50000-0x0000000000FD3000-memory.dmp

Download

memory/5876-62-0x0000000000BD0000-0x0000000000C53000-memory.dmp

Download

memory/5876-68-0x0000000000BD0000-0x0000000000C53000-memory.dmp

Download

memory/5924-166-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/5924-173-0x0000000000200000-0x0000000000283000-memory.dmp

Download

memory/6084-196-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/6084-187-0x0000000000010000-0x0000000000093000-memory.dmp

Download

memory/6120-5-0x00000000008F0000-0x0000000000973000-memory.dmp

Download

memory/6120-0-0x00000000008F0000-0x0000000000973000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads