3962e40ff178accf839f81010e3ca878229e3f56939612de41a7c4c51643b030

Analysis

max time kernel
113s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_4f86845f59c3215616a03a61dae3c2ee_elex_mafia.exe
Size 520KB
Sample260817-m9nceayelf
SHA256 3962e40ff178accf839f81010e3ca878229e3f56939612de41a7c4c51643b030
MD5 4f86845f59c3215616a03a61dae3c2ee
SHA1 29463f6a38afef428600281bddb4da07015b2f97
SHA512 5d47edf111aa096532bfb594ea3255a9254bac88dd26878d8ede73db22abbd9873ab66bcf8e53a39585aaf609bb2ed8a9f7d37fa80ba6e20966c8fceeca0a09d
SSDEEP 12288:gj8fuxR21t5i8fljymCRVegQbMHaOdWz9EIAa18ijmHBp2rNNZ6:gj8fuK1GYtrCGgQbMHa8WDT18iyhp2rs
TLSH
T172B4F1127544C032E9E318764B26DB611BBABD758B3695C73B8037AD6FB22C1DA3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4220	9EF5.tmp
1468	9FA1.tmp
5620	A0BB.tmp
1416	A166.tmp
3432	A2CE.tmp
5912	A399.tmp
5920	A435.tmp
5376	A4F1.tmp
4532	A58D.tmp
3104	A668.tmp
3012	A714.tmp
2800	A7B0.tmp
4784	A84C.tmp
2668	A965.tmp
2504	AA40.tmp
3472	AB0B.tmp
5576	AC24.tmp
2272	ACFF.tmp
2676	ADBB.tmp
1144	AED4.tmp
2788	AFED.tmp
1644	B106.tmp
3276	B1F1.tmp
2700	B2FA.tmp
3616	B3B6.tmp
4544	B4A0.tmp
2852	B58B.tmp
2472	B685.tmp
1936	B731.tmp
2448	B83A.tmp
4204	B915.tmp
1640	B9E0.tmp
1892	BABB.tmp
616	BB96.tmp
2248	BC41.tmp
1984	BCED.tmp
4672	BD7A.tmp
5748	BE35.tmp
6032	BEE1.tmp
1836	BFBC.tmp
4428	C058.tmp
4276	C0E5.tmp
688	C172.tmp
4780	C22D.tmp
4556	C2BA.tmp
5660	C356.tmp
3056	C3F2.tmp
2812	C47F.tmp
1396	C52B.tmp
4180	C5A8.tmp
4332	C644.tmp
1128	C6F0.tmp
552	C78C.tmp
4896	C857.tmp
5328	C8F3.tmp
4996	C990.tmp
2200	CA2C.tmp
4644	CAA9.tmp
1700	CB36.tmp
4268	CBF1.tmp
816	CC9D.tmp
2496	CD49.tmp
2940	CE14.tmp
4052	CEC0.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	283A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC2D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCAA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E495.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3758.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FF1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC41.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CA8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A81.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CC0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D1B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	583E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD7A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	466.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F80.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2433.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7929.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EA7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	975F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D533.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC6C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	590E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9C22.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED4F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCA1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	200.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5D8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BA3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2973.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C1B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DE0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7243.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB8F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3E9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F67.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DA4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE60.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8BC6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C092.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1E3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9A3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47A4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4831.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C356.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE35.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5881.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8639.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92FA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9617.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8C0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB00.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14CD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFBC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF3D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D577.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8AC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2FEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C75.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D89E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBF1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D2E6.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4220	1124	2026-08-17_4f86845f59c3215616a03a61dae3c2ee_elex_mafia.exe	88
PID 4220 wrote to memory of 1468	4220	9EF5.tmp	89
PID 1468 wrote to memory of 5620	1468	9FA1.tmp	90
PID 5620 wrote to memory of 1416	5620	A0BB.tmp	91
PID 1416 wrote to memory of 3432	1416	A166.tmp	92
PID 3432 wrote to memory of 5912	3432	A2CE.tmp	93
PID 5912 wrote to memory of 5920	5912	A399.tmp	94
PID 5920 wrote to memory of 5376	5920	A435.tmp	95
PID 5376 wrote to memory of 4532	5376	A4F1.tmp	96
PID 4532 wrote to memory of 3104	4532	A58D.tmp	97
PID 3104 wrote to memory of 3012	3104	A668.tmp	98
PID 3012 wrote to memory of 2800	3012	A714.tmp	99
PID 2800 wrote to memory of 4784	2800	A7B0.tmp	100
PID 4784 wrote to memory of 2668	4784	A84C.tmp	101
PID 2668 wrote to memory of 2504	2668	A965.tmp	102
PID 2504 wrote to memory of 3472	2504	AA40.tmp	103
PID 3472 wrote to memory of 5576	3472	AB0B.tmp	104
PID 5576 wrote to memory of 2272	5576	AC24.tmp	105
PID 2272 wrote to memory of 2676	2272	ACFF.tmp	106
PID 2676 wrote to memory of 1144	2676	ADBB.tmp	107
PID 1144 wrote to memory of 2788	1144	AED4.tmp	108
PID 2788 wrote to memory of 1644	2788	AFED.tmp	109
PID 1644 wrote to memory of 3276	1644	B106.tmp	110
PID 3276 wrote to memory of 2700	3276	B1F1.tmp	111
PID 2700 wrote to memory of 3616	2700	B2FA.tmp	112
PID 3616 wrote to memory of 4544	3616	B3B6.tmp	113
PID 4544 wrote to memory of 2852	4544	B4A0.tmp	114
PID 2852 wrote to memory of 2472	2852	B58B.tmp	115
PID 2472 wrote to memory of 1936	2472	B685.tmp	116
PID 1936 wrote to memory of 2448	1936	B731.tmp	117
PID 2448 wrote to memory of 4204	2448	B83A.tmp	118
PID 4204 wrote to memory of 1640	4204	B915.tmp	119
PID 1640 wrote to memory of 1892	1640	B9E0.tmp	120
PID 1892 wrote to memory of 616	1892	BABB.tmp	121
PID 616 wrote to memory of 2248	616	BB96.tmp	122
PID 2248 wrote to memory of 1984	2248	BC41.tmp	123
PID 1984 wrote to memory of 4672	1984	BCED.tmp	124
PID 4672 wrote to memory of 5748	4672	BD7A.tmp	125
PID 5748 wrote to memory of 6032	5748	BE35.tmp	126
PID 6032 wrote to memory of 1836	6032	BEE1.tmp	127
PID 1836 wrote to memory of 4428	1836	BFBC.tmp	128
PID 4428 wrote to memory of 4276	4428	C058.tmp	129
PID 4276 wrote to memory of 688	4276	C0E5.tmp	130
PID 688 wrote to memory of 4780	688	C172.tmp	131
PID 4780 wrote to memory of 4556	4780	C22D.tmp	132
PID 4556 wrote to memory of 5660	4556	C2BA.tmp	133
PID 5660 wrote to memory of 3056	5660	C356.tmp	134
PID 3056 wrote to memory of 2812	3056	C3F2.tmp	135
PID 2812 wrote to memory of 1396	2812	C47F.tmp	136
PID 1396 wrote to memory of 4180	1396	C52B.tmp	137
PID 4180 wrote to memory of 4332	4180	C5A8.tmp	138
PID 4332 wrote to memory of 1128	4332	C644.tmp	139
PID 1128 wrote to memory of 552	1128	C6F0.tmp	140
PID 552 wrote to memory of 4896	552	C78C.tmp	141
PID 4896 wrote to memory of 5328	4896	C857.tmp	142
PID 5328 wrote to memory of 4996	5328	C8F3.tmp	143
PID 4996 wrote to memory of 2200	4996	C990.tmp	144
PID 2200 wrote to memory of 4644	2200	CA2C.tmp	145
PID 4644 wrote to memory of 1700	4644	CAA9.tmp	146
PID 1700 wrote to memory of 4268	1700	CB36.tmp	147
PID 4268 wrote to memory of 816	4268	CBF1.tmp	148
PID 816 wrote to memory of 2496	816	CC9D.tmp	149
PID 2496 wrote to memory of 2940	2496	CD49.tmp	150
PID 2940 wrote to memory of 4052	2940	CE14.tmp	151

C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f86845f59c3215616a03a61dae3c2ee_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f86845f59c3215616a03a61dae3c2ee_elex_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\9EF5.tmp
  "C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Local\Temp\9FA1.tmp
    "C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\A0BB.tmp
      "C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\A166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A166.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\A2CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\A399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A399.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\A435.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A435.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\A4F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\A58D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A58D.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\A668.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A668.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\A714.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A714.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\A7B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\A84C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A84C.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\A965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A965.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\AA40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA40.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\AB0B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\AC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC24.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\ACFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\ADBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\AED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AED4.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\AFED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFED.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\B106.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B106.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\B1F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\B2FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\B3B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\B4A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\B58B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B58B.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\B685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B685.tmp"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\B731.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B731.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\B83A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B83A.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\B915.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B915.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\B9E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\BABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BABB.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\BB96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB96.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\BC41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC41.tmp"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\BCED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCED.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\BD7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\BE35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE35.tmp"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\BEE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\BFBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\C058.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C058.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\C0E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\C172.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C172.tmp"
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\C22D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C22D.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\C2BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\C356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C356.tmp"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\C3F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\C47F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C47F.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\C52B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C52B.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\C5A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\C644.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C644.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\C6F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\C78C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C78C.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\C857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C857.tmp"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\C8F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\C990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C990.tmp"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\CA2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\CAA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\CB36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB36.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\CBF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\CC9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\CD49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD49.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\CE14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE14.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\CEC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"
        65⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\CF3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\CFBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"
        67⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\D056.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D056.tmp"
        68⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\D0F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"
        69⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\D1CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"
        70⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\D269.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D269.tmp"
        71⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\D2E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\D3A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"
        73⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\D45D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D45D.tmp"
        74⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\D4EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"
        75⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\D577.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D577.tmp"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\D603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D603.tmp"
        77⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\D6BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"
        78⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\D72C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D72C.tmp"
        79⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\D7E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"
        80⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\D893.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D893.tmp"
        81⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\D920.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D920.tmp"
        82⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\D9AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"
        83⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\DA39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA39.tmp"
        84⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\DAB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"
        85⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\DB53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB53.tmp"
        86⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\DBD0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"
        87⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\DC6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\DD18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD18.tmp"
        89⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\DDD3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"
        90⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\DE9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"
        91⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\DF69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF69.tmp"
        92⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\E015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E015.tmp"
        93⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\E0C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"
        94⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\E16D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E16D.tmp"
        95⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\E209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E209.tmp"
        96⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\E296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E296.tmp"
        97⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\E342.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E342.tmp"
        98⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\E3CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"
        99⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\E48A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E48A.tmp"
        100⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\E536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E536.tmp"
        101⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\E5B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"
        102⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\E63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E63F.tmp"
        103⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\E6DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"
        104⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\E759.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E759.tmp"
        105⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\E7D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"
        106⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\E891.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E891.tmp"
        107⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\E90E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E90E.tmp"
        108⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\E9AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"
        109⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\EA47.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA47.tmp"
        110⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\EAE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"
        111⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\EB70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB70.tmp"
        112⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\EC1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"
        113⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\ECA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"
        114⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\ED44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED44.tmp"
        115⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\EDC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"
        116⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\EE9C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE9C.tmp"
        117⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\EF48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF48.tmp"
        118⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\EFC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"
        119⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\F052.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F052.tmp"
        120⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\F0BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"
        121⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\F15B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15B.tmp"
        122⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\F1F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"
        123⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\F284.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F284.tmp"
        124⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\F311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F311.tmp"
        125⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\F39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F39D.tmp"
        126⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\F459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F459.tmp"
        127⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\F505.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F505.tmp"
        128⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\F5B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"
        129⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\F63D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63D.tmp"
        130⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\F6D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"
        131⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\F766.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F766.tmp"
        132⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\F812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F812.tmp"
        133⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\F8BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"
        134⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\F95A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F95A.tmp"
        135⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\FA06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA06.tmp"
        136⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\FAA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"
        137⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\FB2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"
        138⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\FBBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"
        139⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\FC87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC87.tmp"
        140⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\FD13.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD13.tmp"
        141⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\FD90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD90.tmp"
        142⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\FE1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"
        143⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\FEB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"
        144⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\FF55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF55.tmp"
        145⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11.tmp"
        146⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD.tmp"
        147⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\159.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\159.tmp"
        148⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\1F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F5.tmp"
        149⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\291.tmp"
        150⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\33D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33D.tmp"
        151⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\3DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DA.tmp"
        152⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\466.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\466.tmp"
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\4F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F3.tmp"
        154⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\58F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58F.tmp"
        155⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\60C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60C.tmp"
        156⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\6D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D7.tmp"
        157⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\7A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A2.tmp"
        158⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\82F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82F.tmp"
        159⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\8AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC.tmp"
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\948.tmp"
        161⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\9C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C5.tmp"
        162⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\A61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A61.tmp"
        163⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\ACF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACF.tmp"
        164⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\B6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6B.tmp"
        165⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\BE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE8.tmp"
        166⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\C55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C55.tmp"
        167⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\CD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD2.tmp"
        168⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6F.tmp"
        169⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFB.tmp"
        170⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\E88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E88.tmp"
        171⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\F15.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F15.tmp"
        172⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA1.tmp"
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\101E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\101E.tmp"
        174⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\10AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10AB.tmp"
        175⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\1118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1118.tmp"
        176⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\11D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11D4.tmp"
        177⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\1251.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1251.tmp"
        178⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\12CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12CE.tmp"
        179⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\135A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\135A.tmp"
        180⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\13D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13D7.tmp"
        181⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\1445.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1445.tmp"
        182⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\14D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14D1.tmp"
        183⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\155E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\155E.tmp"
        184⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\15EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15EB.tmp"
        185⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\1658.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1658.tmp"
        186⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\1704.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1704.tmp"
        187⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\17B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B0.tmp"
        188⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\183C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\183C.tmp"
        189⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\18C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18C9.tmp"
        190⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\1936.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1936.tmp"
        191⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\19C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19C3.tmp"
        192⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\1A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A30.tmp"
        193⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\1AFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"
        194⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\1BC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"
        195⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\1C72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C72.tmp"
        196⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\1CEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"
        197⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\1D7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"
        198⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\1DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"
        199⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\1E66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E66.tmp"
        200⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\1EF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"
        201⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\1F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F80.tmp"
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\1FFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"
        203⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\2099.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2099.tmp"
        204⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\2135.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2135.tmp"
        205⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\21D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21D1.tmp"
        206⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\227D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\227D.tmp"
        207⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\230A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\230A.tmp"
        208⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\23A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23A6.tmp"
        209⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\2433.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2433.tmp"
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\24BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24BF.tmp"
        211⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\253C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\253C.tmp"
        212⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\25F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25F8.tmp"
        213⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\2675.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2675.tmp"
        214⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\2702.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2702.tmp"
        215⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\279E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\279E.tmp"
        216⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\283A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\283A.tmp"
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\28C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28C7.tmp"
        218⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\2973.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2973.tmp"
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\2A0F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"
        220⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\2ABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"
        221⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\2B67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B67.tmp"
        222⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\2C12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C12.tmp"
        223⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\2CBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"
        224⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\2D3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D3B.tmp"
        225⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\2DC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"
        226⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\2E26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E26.tmp"
        227⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\2EC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"
        228⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\2F3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"
        229⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\2FEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\3077.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3077.tmp"
        231⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\30F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30F4.tmp"
        232⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\3171.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3171.tmp"
        233⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\322D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\322D.tmp"
        234⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\32BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32BA.tmp"
        235⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\3365.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3365.tmp"
        236⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\33E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33E2.tmp"
        237⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\347F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\347F.tmp"
        238⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\350B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\350B.tmp"
        239⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\3588.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3588.tmp"
        240⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\3605.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3605.tmp"
        241⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\3673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3673.tmp"
        242⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\36FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36FF.tmp"
        243⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\378C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\378C.tmp"
        244⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\3809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3809.tmp"
        245⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\3886.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3886.tmp"
        246⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\3903.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3903.tmp"
        247⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\3990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3990.tmp"
        248⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\3A2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"
        249⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\3AC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"
        250⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\3B55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B55.tmp"
        251⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\3BF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"
        252⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\3C6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"
        253⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\3CFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"
        254⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\3D78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D78.tmp"
        255⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\3DE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"
        256⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\3E81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E81.tmp"
        257⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\3F1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"
        258⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\3F7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"
        259⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\4008.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4008.tmp"
        260⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\40A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40A4.tmp"
        261⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\4121.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4121.tmp"
        262⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\41CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41CD.tmp"
        263⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\423A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\423A.tmp"
        264⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\42C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42C7.tmp"
        265⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\4363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4363.tmp"
        266⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\43FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43FF.tmp"
        267⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\44BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\44BB.tmp"
        268⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\4567.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4567.tmp"
        269⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\45F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45F3.tmp"
        270⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\4690.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4690.tmp"
        271⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\470D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\470D.tmp"
        272⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\478A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\478A.tmp"
        273⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\4826.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4826.tmp"
        274⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\48D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48D2.tmp"
        275⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\496E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\496E.tmp"
        276⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\49EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49EB.tmp"
        277⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\4A87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A87.tmp"
        278⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\4B14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B14.tmp"
        279⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\4BA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"
        280⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\4C3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C3D.tmp"
        281⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\4CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"
        282⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\4D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D37.tmp"
        283⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\4DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\4E21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E21.tmp"
        285⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\4E8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E8F.tmp"
        286⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\4F2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"
        287⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\4F98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F98.tmp"
        288⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\5025.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5025.tmp"
        289⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\50C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\50C1.tmp"
        290⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\511F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\511F.tmp"
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\51BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51BB.tmp"
        292⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\5257.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5257.tmp"
        293⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\52B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52B5.tmp"
        294⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\5332.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5332.tmp"
        295⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\53EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53EE.tmp"
        296⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\546B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\546B.tmp"
        297⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\54F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54F7.tmp"
        298⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\55A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55A3.tmp"
        299⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\564F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\564F.tmp"
        300⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\56BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56BC.tmp"
        301⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\5778.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5778.tmp"
        302⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\57F5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57F5.tmp"
        303⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\5881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5881.tmp"
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\590E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\590E.tmp"
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\597B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\597B.tmp"
        306⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\59F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59F8.tmp"
        307⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\5A85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A85.tmp"
        308⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\5B02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B02.tmp"
        309⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\5B9E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"
        310⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\5C1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"
        311⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\5CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\5D44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D44.tmp"
        313⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\5DE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DE0.tmp"
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\5E8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E8C.tmp"
        315⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\5F29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F29.tmp"
        316⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\5FB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FB5.tmp"
        317⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\6051.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6051.tmp"
        318⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\60DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60DE.tmp"
        319⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\617A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\617A.tmp"
        320⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\6207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6207.tmp"
        321⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\6294.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6294.tmp"
        322⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\6311.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6311.tmp"
        323⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\639D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\639D.tmp"
        324⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\6449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6449.tmp"
        325⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\6514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6514.tmp"
        326⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\65C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65C0.tmp"
        327⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\665C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\665C.tmp"
        328⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\6737.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6737.tmp"
        329⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\67C4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67C4.tmp"
        330⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\6860.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6860.tmp"
        331⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\68ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68ED.tmp"
        332⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\6D71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D71.tmp"
        333⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\6DEE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"
        334⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\6E7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E7A.tmp"
        335⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\6F17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F17.tmp"
        336⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\6FD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"
        337⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\705F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\705F.tmp"
        338⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\711A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\711A.tmp"
        339⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\71C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71C6.tmp"
        340⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\7243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7243.tmp"
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\72C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72C0.tmp"
        342⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\734D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\734D.tmp"
        343⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\7418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7418.tmp"
        344⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\74B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74B4.tmp"
        345⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\7550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7550.tmp"
        346⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\75DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75DD.tmp"
        347⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\765A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\765A.tmp"
        348⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\76E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76E7.tmp"
        349⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\7764.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7764.tmp"
        350⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\77F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77F0.tmp"
        351⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\78AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78AC.tmp"
        352⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\7929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7929.tmp"
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\79C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79C5.tmp"
        354⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\7A81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A81.tmp"
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\7B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"
        356⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\7B8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"
        357⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\7BF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"
        358⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\7C75.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C75.tmp"
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\7CF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"
        360⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\7D6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D6F.tmp"
        361⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\7DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"
        362⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\7EA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EA7.tmp"
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\7F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F63.tmp"
        364⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\7FEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"
        365⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\806C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\806C.tmp"
        366⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\8118.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8118.tmp"
        367⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\8176.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8176.tmp"
        368⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\8222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8222.tmp"
        369⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\828F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\828F.tmp"
        370⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\82FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82FC.tmp"
        371⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\8389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8389.tmp"
        372⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\8406.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8406.tmp"
        373⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\8493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8493.tmp"
        374⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\852F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\852F.tmp"
        375⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\85AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85AC.tmp"
        376⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\8639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8639.tmp"
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\86C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86C5.tmp"
        378⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\8761.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8761.tmp"
        379⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\884C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\884C.tmp"
        380⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\88C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88C9.tmp"
        381⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\8984.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8984.tmp"
        382⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\8A30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A30.tmp"
        383⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\8ACC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"
        384⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\8B49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B49.tmp"
        385⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\8BC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\8C43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C43.tmp"
        387⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\8CC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CC0.tmp"
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\8D3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"
        389⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\8DAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"
        390⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\8E57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E57.tmp"
        391⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\8ED4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8ED4.tmp"
        392⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\8F80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F80.tmp"
        393⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\903B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\903B.tmp"
        394⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\90B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90B8.tmp"
        395⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\9145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9145.tmp"
        396⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\91E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91E1.tmp"
        397⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\926E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\926E.tmp"
        398⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\92FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92FA.tmp"
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\9368.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9368.tmp"
        400⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\93E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E5.tmp"
        401⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\9462.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9462.tmp"
        402⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\94EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94EE.tmp"
        403⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\95AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95AA.tmp"
        404⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\9617.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9617.tmp"
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\96B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96B3.tmp"
        406⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\975F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\975F.tmp"
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\97CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97CD.tmp"
        408⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\9869.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9869.tmp"
        409⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\98E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98E6.tmp"
        410⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\9982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9982.tmp"
        411⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\9A5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A5D.tmp"
        412⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\9AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"
        413⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\9B95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B95.tmp"
        414⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\9C22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C22.tmp"
        415⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\9CBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"
        416⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\9D3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"
        417⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\9DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"
        418⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\9EA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EA3.tmp"
        419⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\9F20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F20.tmp"
        420⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\9FDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FDB.tmp"
        421⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\A097.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A097.tmp"
        422⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\A123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A123.tmp"
        423⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\A1EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A1EE.tmp"
        424⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\A29A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A29A.tmp"
        425⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\A346.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A346.tmp"
        426⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\A3C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3C3.tmp"
        427⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\A440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A440.tmp"
        428⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\A4CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"
        429⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\A569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A569.tmp"
        430⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\A5D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5D6.tmp"
        431⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\A673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A673.tmp"
        432⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\A6F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6F0.tmp"
        433⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\A7AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7AB.tmp"
        434⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\A847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A847.tmp"
        435⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\A8F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8F3.tmp"
        436⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\A9BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"
        437⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\AA3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"
        438⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\AAB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAB8.tmp"
        439⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\AB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB55.tmp"
        440⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\ABD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABD2.tmp"
        441⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\AC6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC6E.tmp"
        442⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\ACEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACEB.tmp"
        443⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\AD97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD97.tmp"
        444⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\AE14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE14.tmp"
        445⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\AE91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE91.tmp"
        446⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\AF1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF1D.tmp"
        447⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\AFC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"
        448⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\B085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B085.tmp"
        449⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\B131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B131.tmp"
        450⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\B1BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1BD.tmp"
        451⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\B21B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B21B.tmp"
        452⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\B2B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2B7.tmp"
        453⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\B344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B344.tmp"
        454⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\B3F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3F0.tmp"
        455⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\B49C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B49C.tmp"
        456⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\B519.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B519.tmp"
        457⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\B596.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B596.tmp"
        458⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\B603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B603.tmp"
        459⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\B670.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B670.tmp"
        460⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\B6ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6ED.tmp"
        461⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\B799.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B799.tmp"
        462⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\B816.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B816.tmp"
        463⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\B8B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8B2.tmp"
        464⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\B92F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B92F.tmp"
        465⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\B9BC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9BC.tmp"
        466⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\BA29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA29.tmp"
        467⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\BAB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAB6.tmp"
        468⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\BB91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB91.tmp"
        469⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\BC2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC2D.tmp"
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\BCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAA.tmp"
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\BD56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD56.tmp"
        472⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\BDE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"
        473⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\BE60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE60.tmp"
        474⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\BEEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"
        475⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\BF88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF88.tmp"
        476⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\C005.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C005.tmp"
        477⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\C092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C092.tmp"
        478⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\C0FF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0FF.tmp"
        479⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\C19C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C19C.tmp"
        480⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\C238.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C238.tmp"
        481⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\C2F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2F3.tmp"
        482⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\C390.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C390.tmp"
        483⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\C3FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C3FD.tmp"
        484⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\C48A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C48A.tmp"
        485⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\C516.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C516.tmp"
        486⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\C5C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5C2.tmp"
        487⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\C65E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C65E.tmp"
        488⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\C6FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C6FB.tmp"
        489⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\C797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C797.tmp"
        490⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\C824.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C824.tmp"
        491⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\C8C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8C0.tmp"
        492⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\C96C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C96C.tmp"
        493⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\C9E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9E9.tmp"
        494⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\CA66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA66.tmp"
        495⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\CAE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE3.tmp"
        496⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\CB8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB8F.tmp"
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\CC5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC5A.tmp"
        498⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\CCE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"
        499⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\CD73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD73.tmp"
        500⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\CE00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE00.tmp"
        501⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\CE7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE7D.tmp"
        502⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\CF19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF19.tmp"
        503⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\CF96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF96.tmp"
        504⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\D003.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D003.tmp"
        505⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\D0AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0AF.tmp"
        506⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\D13C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D13C.tmp"
        507⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\D1B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1B9.tmp"
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\D245.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D245.tmp"
        509⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\D2D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D2D2.tmp"
        510⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\D37E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D37E.tmp"
        511⤵
        
        PID:260
        
        C:\Users\Admin\AppData\Local\Temp\D40A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D40A.tmp"
        512⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\D497.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D497.tmp"
        513⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\D533.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D533.tmp"
        514⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\D5B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5B0.tmp"
        515⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\D66C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D66C.tmp"
        516⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\D708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D708.tmp"
        517⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\D7A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7A4.tmp"
        518⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\D812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D812.tmp"
        519⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\D89E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D89E.tmp"
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\D93B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D93B.tmp"
        521⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\D9D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9D7.tmp"
        522⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\DA63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA63.tmp"
        523⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\DB00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB00.tmp"
        524⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\DBAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBAC.tmp"
        525⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\DC29.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC29.tmp"
        526⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\DCA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCA6.tmp"
        527⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\DD42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD42.tmp"
        528⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\DDCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDCE.tmp"
        529⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\DE8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE8A.tmp"
        530⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\DF07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF07.tmp"
        531⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\DF94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF94.tmp"
        532⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\E001.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E001.tmp"
        533⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\E08E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E08E.tmp"
        534⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\E12A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E12A.tmp"
        535⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\E1C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1C6.tmp"
        536⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\E243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E243.tmp"
        537⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\E2EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E2EF.tmp"
        538⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\E36C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E36C.tmp"
        539⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\E3E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"
        540⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\E495.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E495.tmp"
        541⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\E521.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E521.tmp"
        542⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\E5AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"
        543⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\E679.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E679.tmp"
        544⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\E6F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6F6.tmp"
        545⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\E783.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E783.tmp"
        546⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\E84E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E84E.tmp"
        547⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\E8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E8CB.tmp"
        548⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\E958.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E958.tmp"
        549⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\E9D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9D5.tmp"
        550⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\EA52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA52.tmp"
        551⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\EADE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EADE.tmp"
        552⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\EB5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB5B.tmp"
        553⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\EBF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBF7.tmp"
        554⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\ECA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECA3.tmp"
        555⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\ED4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED4F.tmp"
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\EDFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EDFB.tmp"
        557⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\EE78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE78.tmp"
        558⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\EF14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF14.tmp"
        559⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\EF91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF91.tmp"
        560⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\F04D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F04D.tmp"
        561⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\F0E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F0E9.tmp"
        562⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\F176.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F176.tmp"
        563⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\F1E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1E3.tmp"
        564⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\F27F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F27F.tmp"
        565⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\F2FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2FC.tmp"
        566⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\F379.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F379.tmp"
        567⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\F416.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F416.tmp"
        568⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\F493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F493.tmp"
        569⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\F51F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F51F.tmp"
        570⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\F58D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F58D.tmp"
        571⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\F629.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F629.tmp"
        572⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\F6B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F6B5.tmp"
        573⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\F771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F771.tmp"
        574⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\F7EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7EE.tmp"
        575⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\F88A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F88A.tmp"
        576⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\F926.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F926.tmp"
        577⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\F9A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F9A3.tmp"
        578⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\FA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA30.tmp"
        579⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\FACC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FACC.tmp"
        580⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\FB3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB3A.tmp"
        581⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\FBA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBA7.tmp"
        582⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\FC24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC24.tmp"
        583⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\FCA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCA1.tmp"
        584⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\FD1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD1E.tmp"
        585⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\FDBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FDBA.tmp"
        586⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\FE85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE85.tmp"
        587⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\FF02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF02.tmp"
        588⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\FF8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF8F.tmp"
        589⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B.tmp"
        590⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7.tmp"
        591⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\183.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\183.tmp"
        592⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\200.tmp"
        593⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\28D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D.tmp"
        594⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\319.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\319.tmp"
        595⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\396.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\396.tmp"
        596⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\413.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\413.tmp"
        597⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\490.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\490.tmp"
        598⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\52D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D.tmp"
        599⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\5D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D8.tmp"
        600⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\6A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A4.tmp"
        601⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\730.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\730.tmp"
        602⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\7AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7AD.tmp"
        603⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\849.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\849.tmp"
        604⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\8D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D6.tmp"
        605⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\943.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\943.tmp"
        606⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\9E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E0.tmp"
        607⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\A7C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7C.tmp"
        608⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\B09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B09.tmp"
        609⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC4.tmp"
        610⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\C80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C80.tmp"
        611⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFD.tmp"
        612⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\D89.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D89.tmp"
        613⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\DF7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF7.tmp"
        614⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\E93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E93.tmp"
        615⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\F1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1F.tmp"
        616⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FAC.tmp"
        617⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\1048.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1048.tmp"
        618⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\10C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10C5.tmp"
        619⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\1133.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1133.tmp"
        620⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\11A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11A0.tmp"
        621⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\124C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\124C.tmp"
        622⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\12C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12C9.tmp"
        623⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\1365.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1365.tmp"
        624⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\13D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\13D3.tmp"
        625⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\1440.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1440.tmp"
        626⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\14CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14CD.tmp"
        627⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\1559.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1559.tmp"
        628⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\15E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15E6.tmp"
        629⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\1672.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1672.tmp"
        630⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\16EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16EF.tmp"
        631⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\176C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\176C.tmp"
        632⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\17E9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17E9.tmp"
        633⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\1857.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1857.tmp"
        634⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\18F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18F3.tmp"
        635⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\1970.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1970.tmp"
        636⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\19FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19FD.tmp"
        637⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\1A99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A99.tmp"
        638⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\1B06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B06.tmp"
        639⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\1BA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BA3.tmp"
        640⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\1C3F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C3F.tmp"
        641⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\1CCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CCB.tmp"
        642⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\1D48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D48.tmp"
        643⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\1DD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DD5.tmp"
        644⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\1E71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E71.tmp"
        645⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\1F0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F0E.tmp"
        646⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\1F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F9A.tmp"
        647⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\2017.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2017.tmp"
        648⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\20A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20A4.tmp"
        649⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\2130.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2130.tmp"
        650⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\21DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21DC.tmp"
        651⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\22A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22A7.tmp"
        652⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\2392.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2392.tmp"
        653⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\241E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\241E.tmp"
        654⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\249B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\249B.tmp"
        655⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\2528.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2528.tmp"
        656⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\2595.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2595.tmp"
        657⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\2632.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2632.tmp"
        658⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\26AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26AF.tmp"
        659⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\275B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\275B.tmp"
        660⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\27D8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27D8.tmp"
        661⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\2864.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2864.tmp"
        662⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\28F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28F1.tmp"
        663⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\295E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\295E.tmp"
        664⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\29EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29EB.tmp"
        665⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\2A77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A77.tmp"
        666⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\2AE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AE5.tmp"
        667⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\2BA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BA0.tmp"
        668⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\2C1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C1D.tmp"
        669⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\2C8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C8B.tmp"
        670⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\2D37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D37.tmp"
        671⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\2DC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC3.tmp"
        672⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\2E40.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E40.tmp"
        673⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\2ECD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2ECD.tmp"
        674⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\2F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F79.tmp"
        675⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\3005.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3005.tmp"
        676⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\3092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3092.tmp"
        677⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\315D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\315D.tmp"
        678⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\3209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3209.tmp"
        679⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\32B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32B5.tmp"
        680⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\3351.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3351.tmp"
        681⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\33ED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33ED.tmp"
        682⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\346A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\346A.tmp"
        683⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\3507.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3507.tmp"
        684⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\35A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35A3.tmp"
        685⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\364F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\364F.tmp"
        686⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\36EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36EB.tmp"
        687⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\3758.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3758.tmp"
        688⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\37E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37E5.tmp"
        689⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\3881.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3881.tmp"
        690⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\391D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\391D.tmp"
        691⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\39AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\39AA.tmp"
        692⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\3A37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A37.tmp"
        693⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\3AB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AB4.tmp"
        694⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\3B50.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B50.tmp"
        695⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\3BBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BBD.tmp"
        696⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\3C4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C4A.tmp"
        697⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\3CC7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3CC7.tmp"
        698⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\3DA2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DA2.tmp"
        699⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\3E1F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E1F.tmp"
        700⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\3EAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EAB.tmp"
        701⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\3F67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F67.tmp"
        702⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\4003.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4003.tmp"
        703⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\4080.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4080.tmp"
        704⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\410D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\410D.tmp"
        705⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\417A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\417A.tmp"
        706⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\4207.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4207.tmp"
        707⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\42A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42A3.tmp"
        708⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\4330.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4330.tmp"
        709⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\43CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43CC.tmp"
        710⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\4458.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4458.tmp"
        711⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\4514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4514.tmp"
        712⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\45DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45DF.tmp"
        713⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\467B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\467B.tmp"
        714⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\4708.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4708.tmp"
        715⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\47A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47A4.tmp"
        716⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\4831.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4831.tmp"
        717⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\48AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48AE.tmp"
        718⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\492B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\492B.tmp"
        719⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\49A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\49A8.tmp"
        720⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\4A44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A44.tmp"
        721⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\4AB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AB1.tmp"
        722⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\4B3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B3E.tmp"
        723⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\4BCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BCB.tmp"
        724⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\4C77.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C77.tmp"
        725⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\4D03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D03.tmp"
        726⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\4D80.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D80.tmp"
        727⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\4DFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DFD.tmp"
        728⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\4E6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E6B.tmp"
        729⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\4EE8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EE8.tmp"
        730⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\4F65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F65.tmp"
        731⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\4FF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4FF1.tmp"
        732⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\508D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\508D.tmp"
        733⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\512A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\512A.tmp"
        734⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\51B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51B6.tmp"
        735⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\5233.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5233.tmp"
        736⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\52D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\52D0.tmp"
        737⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\533D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\533D.tmp"
        738⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\53AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53AA.tmp"
        739⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\5418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5418.tmp"
        740⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\54D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54D3.tmp"
        741⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\5560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5560.tmp"
        742⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\560C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\560C.tmp"
        743⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\5698.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5698.tmp"
        744⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\5735.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5735.tmp"
        745⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\57D1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57D1.tmp"
        746⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\583E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\583E.tmp"
        747⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\58EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58EA.tmp"
        748⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\5957.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5957.tmp"
        749⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\59E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\59E4.tmp"
        750⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\5A51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A51.tmp"
        751⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\5ADE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5ADE.tmp"
        752⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\5B4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B4B.tmp"
        753⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\5BC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5BC8.tmp"
        754⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\5C55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C55.tmp"
        755⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\5CF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CF1.tmp"
        756⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\5D5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D5F.tmp"
        757⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\5DEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5DEB.tmp"
        758⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\5E97.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E97.tmp"
        759⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\5F24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F24.tmp"
        760⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\5FC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FC0.tmp"
        761⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\603D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\603D.tmp"
        762⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\60AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60AA.tmp"
        763⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\6127.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6127.tmp"
        764⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\6195.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6195.tmp"
        765⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\6221.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6221.tmp"
        766⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\629E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\629E.tmp"
        767⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\631B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\631B.tmp"
        768⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\6389.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6389.tmp"
        769⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\6425.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6425.tmp"
        770⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\64C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64C1.tmp"
        771⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\654E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\654E.tmp"
        772⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\65BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65BB.tmp"
        773⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\6648.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6648.tmp"
        774⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\6703.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6703.tmp"
        775⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\6771.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6771.tmp"
        776⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\67EE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67EE.tmp"
        777⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\687A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\687A.tmp"
        778⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\68E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68E8.tmp"
        779⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\6974.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6974.tmp"
        780⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\6A01.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A01.tmp"
        781⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\6A7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A7E.tmp"
        782⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\6B3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B3A.tmp"
        783⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\6BA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BA7.tmp"
        784⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\6C34.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C34.tmp"
        785⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\6CB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CB1.tmp"
        786⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\6D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D2E.tmp"
        787⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\6DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DE9.tmp"
        788⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\6EC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EC4.tmp"
        789⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\6F70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F70.tmp"
        790⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\701C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\701C.tmp"
        791⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\70C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70C7.tmp"
        792⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\7173.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7173.tmp"
        793⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\71F0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71F0.tmp"
        794⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\728D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\728D.tmp"
        795⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\730A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\730A.tmp"
        796⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\73B5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\73B5.tmp"
        797⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\7452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7452.tmp"
        798⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\74FE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74FE.tmp"
        799⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\75A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75A9.tmp"
        800⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\7655.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7655.tmp"
        801⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\76F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76F2.tmp"
        802⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\77AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77AD.tmp"
        803⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\782A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\782A.tmp"
        804⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\78A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78A7.tmp"
        805⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\7963.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7963.tmp"
        806⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\79EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79EF.tmp"
        807⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\7A8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A8B.tmp"
        808⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\7B57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B57.tmp"
        809⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\7C02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C02.tmp"
        810⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\7CBE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"
        811⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\7D5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"
        812⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\7E35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E35.tmp"
        813⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\7F00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F00.tmp"
        814⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\7FAC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FAC.tmp"
        815⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\8067.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8067.tmp"
        816⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\8161.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8161.tmp"
        817⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\821D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\821D.tmp"
        818⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\82C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82C9.tmp"
        819⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\8355.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8355.tmp"
        820⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\83D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83D2.tmp"
        821⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\848E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\848E.tmp"
        822⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\852A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\852A.tmp"
        823⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\85C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85C6.tmp"
        824⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\8663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8663.tmp"
        825⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\86EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86EF.tmp"
        826⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\87BA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87BA.tmp"
        827⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\8837.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8837.tmp"
        828⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\88D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88D4.tmp"
        829⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\898F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\898F.tmp"
        830⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\8A5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A5A.tmp"
        831⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\8B06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B06.tmp"
        832⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\8B93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B93.tmp"
        833⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\8C5E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C5E.tmp"
        834⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\8CFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8CFA.tmp"
        835⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\8DB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DB6.tmp"
        836⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\8E33.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E33.tmp"
        837⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\8EFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EFE.tmp"
        838⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\8F9A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F9A.tmp"
        839⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\9036.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9036.tmp"
        840⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\9101.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9101.tmp"
        841⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\91FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91FB.tmp"
        842⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\9298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9298.tmp"
        843⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\9344.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9344.tmp"
        844⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\93E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93E0.tmp"
        845⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\946C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\946C.tmp"
        846⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\9509.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9509.tmp"
        847⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\9595.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9595.tmp"
        848⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\9612.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9612.tmp"
        849⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\969F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\969F.tmp"
        850⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\972C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\972C.tmp"
        851⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\97B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97B8.tmp"
        852⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\9854.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9854.tmp"
        853⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\98F1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98F1.tmp"
        854⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\997D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\997D.tmp"
        855⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\99FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99FA.tmp"
        856⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\9AB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AB6.tmp"
        857⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\9B52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B52.tmp"
        858⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\9BDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BDF.tmp"
        859⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\9C5C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C5C.tmp"
        860⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\9CF8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CF8.tmp"
        861⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\9DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DA4.tmp"
        862⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\9E30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E30.tmp"
        863⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\9EDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EDC.tmp"
        864⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\9F59.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F59.tmp"
        865⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\9FF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FF6.tmp"
        866⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\A082.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A082.tmp"
        867⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\A11E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A11E.tmp"
        868⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\A209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A209.tmp"
        869⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\A295.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A295.tmp"
        870⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\A312.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A312.tmp"
        871⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\A3CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"
        872⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\A499.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A499.tmp"
        873⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\A516.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A516.tmp"
        874⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\A5B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A5B2.tmp"
        875⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\A68D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A68D.tmp"
        876⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\A71A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A71A.tmp"
        877⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\A797.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A797.tmp"
        878⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\A814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A814.tmp"
        879⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\A8C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8C0.tmp"
        880⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\A95C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A95C.tmp"
        881⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\A9D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A9D9.tmp"
        882⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\AA65.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA65.tmp"
        883⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\AB21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB21.tmp"
        884⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\ABBD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABBD.tmp"
        885⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\AC69.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC69.tmp"
        886⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\AD05.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD05.tmp"
        887⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\AD92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD92.tmp"
        888⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\AE2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE2E.tmp"
        889⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\AEBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEBB.tmp"
        890⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\AF57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF57.tmp"
        891⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\AFF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AFF3.tmp"
        892⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\B061.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B061.tmp"
        893⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\B0FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0FD.tmp"
        894⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\B17A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B17A.tmp"
        895⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\B226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B226.tmp"
        896⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\B2C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B2C2.tmp"
        897⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\B34F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B34F.tmp"
        898⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\B3FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3FB.tmp"
        899⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\B4A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4A6.tmp"
        900⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\B543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B543.tmp"
        901⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\B5EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5EF.tmp"
        902⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\B67B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B67B.tmp"
        903⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\B717.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B717.tmp"
        904⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\B7B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B7B4.tmp"
        905⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\B821.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B821.tmp"
        906⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\B8AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8AE.tmp"
        907⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\B9A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9A8.tmp"
        908⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\BA44.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA44.tmp"
        909⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\BAC1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BAC1.tmp"
        910⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\BB4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB4E.tmp"
        911⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\BBF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBF9.tmp"
        912⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\BC96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC96.tmp"
        913⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\BD42.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD42.tmp"
        914⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\BDBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDBF.tmp"
        915⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\BE5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE5B.tmp"
        916⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\BEC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEC8.tmp"
        917⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\BF55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF55.tmp"
        918⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\BFC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BFC2.tmp"
        919⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\C08D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C08D.tmp"
        920⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\C139.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C139.tmp"
        921⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\C1D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1D5.tmp"
        922⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\C291.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C291.tmp"
        923⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\C31E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C31E.tmp"
        924⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\C39B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C39B.tmp"
        925⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\C437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C437.tmp"
        926⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\C4D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4D3.tmp"
        927⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\C550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C550.tmp"
        928⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\C5FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5FC.tmp"
        929⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\C698.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C698.tmp"
        930⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\C725.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C725.tmp"
        931⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\C7C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7C1.tmp"
        932⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\C83E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C83E.tmp"
        933⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\C8CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"
        934⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\C948.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C948.tmp"
        935⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\C9D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"
        936⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\CA51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA51.tmp"
        937⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\CB0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB0D.tmp"
        938⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\CBA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBA9.tmp"
        939⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\CC26.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC26.tmp"
        940⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\CCC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCC2.tmp"
        941⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\CD4F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD4F.tmp"
        942⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\CDBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDBC.tmp"
        943⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\CE49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE49.tmp"
        944⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\CEE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEE5.tmp"
        945⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\CF91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF91.tmp"
        946⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\CFFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CFFE.tmp"
        947⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\D07B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D07B.tmp"
        948⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\D147.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D147.tmp"
        949⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\D1D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1D3.tmp"
        950⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\D29E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D29E.tmp"
        951⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\D34A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D34A.tmp"
        952⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\D3B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3B8.tmp"
        953⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\D463.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D463.tmp"
        954⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\D54E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D54E.tmp"
        955⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\D5EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5EA.tmp"
        956⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\D696.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D696.tmp"
        957⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\D723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D723.tmp"
        958⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\D7AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D7AF.tmp"
        959⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\D82C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D82C.tmp"
        960⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\D8A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8A9.tmp"
        961⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\D945.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D945.tmp"
        962⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\D9E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9E2.tmp"
        963⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\DA7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA7E.tmp"
        964⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\DB49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB49.tmp"
        965⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\DBE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBE5.tmp"
        966⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\DCC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCC0.tmp"
        967⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\DD6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD6C.tmp"
        968⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\DDF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DDF9.tmp"
        969⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\DE95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE95.tmp"
        970⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\DF41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF41.tmp"
        971⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\DFCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFCD.tmp"
        972⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\E05A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E05A.tmp"
        973⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\E0C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0C7.tmp"
        974⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\E164.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E164.tmp"
        975⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\E200.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E200.tmp"
        976⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\E27D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E27D.tmp"
        977⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\E319.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E319.tmp"
        978⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\E3D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3D5.tmp"
        979⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\E471.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E471.tmp"
        980⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\E52C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E52C.tmp"
        981⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\E5E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E5E8.tmp"
        982⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\E684.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E684.tmp"
        983⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\E720.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E720.tmp"
        984⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\E7BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7BD.tmp"
        985⤵
        
        PID:7828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9EF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\9EF5.tmp
Size 520KB
SHA256 92c323d941226ce4c1a4dada0575ed060a5785a8d4ba45a058afca7de597c6e5
MD5 c368ad66e436bed88fedf9cfb26ae673
SHA1 b9e2df9404d1068b88ce6419e9e466a8476a16b8
SHA512 533d2dd1445dc16316382f4954db8c3f2ef79323421e0fd96be8c97108c467f78d0e788c966474f12ed5538a35357b7cea49f8e8cb7147383700e72fdaa93375
SSDEEP 12288:gj8fuxR21t5i8f5V1PZsRRM4Kp9kFvjNZ6:gj8fuK1GYIRu4RZNI
TLSH
T1A1B4F011B884C033E9971A315A56CBA24BBEBD748B3595C337C436ADAEB52C0DB7530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9FA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\9FA1.tmp
Size 520KB
SHA256 83678df95fa52e22d09576cfc68d7ed712af1b88a5a62f8a3df08457def2122b
MD5 468a2119af2d7f84cdfcf0267f273fd4
SHA1 b5f4b20f57f1a1d6d9b38ec37e827382dd1cd385
SHA512 67b79d381697074934edc8a54e65bde9fcc30da4f89132f3973c3d2fa8c469c1574c800c9799488425c113fec74f4c8d73f017a0a6bc0cbbd78ccaa9afba5827
SSDEEP 12288:gj8fuxR21t5i8fYCM7tuC5Zr7weqAlpMNZ6:gj8fuK1GYg5tvE8pMNI
TLSH
T1A8B4F1027985C033E9E729354A62DB6107BE7D798B3695C73B80367E6FB52C1963830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A0BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\A0BB.tmp
Size 520KB
SHA256 ce1fb6b1421553f6744f4b62cb35d3fd42f73e6f63c9e84f632b003ae65d1719
MD5 0ba61036b4332544ecfde6d71ddeb182
SHA1 81045947992fe61181f8d4ed784240053b7882e3
SHA512 a0f79aea0fe30ca89084948130a897431858c1428c2459242b986e8ff8b06909c0851c3770116bb76b5ef1c9f9953a82d6b75f03bfa907c41f895a20281c3e88
SSDEEP 12288:gj8fuxR21t5i8f23Qzq0WAbpuVu1assxJNZ6:gj8fuK1GY2EUA9Xw3xJNI
TLSH
T194B4F102B944C033E9A216314B66DBA54BBE7D755B36A5C73B8032AD6FF42D1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A166.tmp

Path C:\Users\Admin\AppData\Local\Temp\A166.tmp
Size 520KB
SHA256 fdace2105b76d167625478154c5956ba8ebb2b59b9a15ddbe5b1d13de7b63b3d
MD5 180ad238337d356a3df534b4d171f904
SHA1 124f4240f1f3dcae79eaa6e6994f9c06f8a7fca4
SHA512 8941b19f7a23dec14386d0524000d0fa880cb7b52b8641c349106dc489c2f4c107374995317c6c1f006938a06d4aee345810434cbe5f5f164208e58a402d9b51
SSDEEP 12288:gj8fuxR21t5i8fWOPlvmuZsB9mW1HTW2+HqNNZ6:gj8fuK1GYVdZsB9P1fGqNNI
TLSH
T14AB4F012B848C037E49205315B66DBA11BBF7C398B3695C33B84366D6FB52D1EA7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A2CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\A2CE.tmp
Size 520KB
SHA256 6c62969d6a404c9420c2e08dd16c915ac95ce69bbfdbafc5152eb396c0c7b5cf
MD5 4201845c98d1e6cd488441664c44c38b
SHA1 cdbea242b17d67fbaa9370cb25ee14ba009a3f09
SHA512 43833ca86334e57ef10ff429653bdea9fdc3c67798dfbefb07544d22a1eef911830ab8cad1e03e1a8fe382530c623455bed15f09ecb305ebfc744d2b2083b45d
SSDEEP 12288:gj8fuxR21t5i8fXFNwVvsy6qLc9NkokzcDURVZlgS2NZ6:gj8fuK1GYXrwVhHLyNkRzcDURvlh2NI
TLSH
T12DB4F0113485C036E9C615304B56CBA11BBEBD319B7695CB3BC43A6DAFB12D2E63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A399.tmp

Path C:\Users\Admin\AppData\Local\Temp\A399.tmp
Size 520KB
SHA256 fc89ee7a82a3d130dc56e4c45a5a0ccbf6cedf942ce10032edca00eb92c36134
MD5 0f3888820b32b77e37a9dac6b42c2dcc
SHA1 fe3a341df73d67b1621b466c03aa98281406da66
SHA512 ba3c92abecbec5b1861cfb28ef7025063150371cecaf74b67f4ed6344e2f145913bd62ee3c68af3c842be57d9446de78f6735db5cdc68abe927dcb82d5b4bdc5
SSDEEP 12288:gj8fuxR21t5i8fiM/BTEnijNSRDdck1LOxb3gTNZ6:gj8fuK1GYbBEij4vcxxb30NI
TLSH
T127B4E012B545C032E4E211315B66DBA20BBF3D399B2595C73BC43A6E2FB52D1DA7830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A435.tmp

Path C:\Users\Admin\AppData\Local\Temp\A435.tmp
Size 520KB
SHA256 ae0c1dbc234c4868ad3b216c260ec21d36999eeff42b56f2af3af16b1a63ae7b
MD5 f27e824499282ecbe488e5212805133e
SHA1 2ccfbc79ba79a3589b3d2229a917e127c87b4ba2
SHA512 9cb84090eff163a39d712168a4324c113eb200bcc8cc3eacdd1de8e306241f5b1c96e0f0ab91a36af33d19c79e07973b8b107d34812fe8ab91cf2fcc748e5e33
SSDEEP 12288:gj8fuxR21t5i8fJWWM7UDIDtfgy7DKbGUuLzPNZ6:gj8fuK1GYJlKyuD5UAzPNI
TLSH
T1B3B4F001B984C033E8E215314B56DBA21BBF7D395B3695C37BC435ADAEB42D2A63431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A4F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\A4F1.tmp
Size 520KB
SHA256 36ec47c84992036dfd4b5737a7292243c3ffec5029578b17d4f9304efb8d8fd0
MD5 ce54bbe9999f0b8503666b5d92e3ebde
SHA1 89206a4de125557ef5a98fc33f8ce11721c7b4b3
SHA512 d9d2b073872bde6d7833a3899823f221d484e9f34893a9567e096da862f7de7fb59cf9175f63562c8c9e0f656a12a67f06f65b2a3b7335494518c6a3428149e8
SSDEEP 12288:gj8fuxR21t5i8fbMTjnAGiDkRhLu6FZkqPNcLONZ6:gj8fuK1GYbxDMduckVLONI
TLSH
T1F9B4F1127988C032E9D615324B16CBA11BBE7D758B2694C737C436AEAFB52C1D73831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A58D.tmp

Path C:\Users\Admin\AppData\Local\Temp\A58D.tmp
Size 520KB
SHA256 e0a6cbcd55b634753a2e4108b003f0699969d4354fc5eac2d4b4069b0b0d5955
MD5 d6c74162eda738a8baa43f931002c395
SHA1 94a9b9f4485ede7b29c49be02e2be12c9fa9c2aa
SHA512 be604356d570045382f1cd305884ae0fe378ac2f1d6c34150afcdf867bfe8bb7bc986e40a570be5c9c9fce31615d9c1f7fa403e591e82e4205e7661f8eac7c53
SSDEEP 12288:gj8fuxR21t5i8fFbqDMFB/BMh8ZebnFtANZ6:gj8fuK1GYFboM3CNnbANI
TLSH
T1F3B4F112B944C033E5E211364B51DB621BBE7C799B3691C73B903A6DAEF52D2D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A668.tmp

Path C:\Users\Admin\AppData\Local\Temp\A668.tmp
Size 520KB
SHA256 8af02b73eca66b824dfb9f5d64823ad2d3047c4f3d9e53e5fd237c40948ec472
MD5 1540bef886d646698486d64f3cd0ba2e
SHA1 283a5ea98a497053f3de5fa575fbeb89e5ec5133
SHA512 de25566c5787c1e222bfba9e9562b0c2eac015783430a03e78f620b1d002a3b205e3b77abb4a24a44258dd420267f4acc67a659786a204286f7df715806c10ff
SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbEof9loo0W/VPtntgTUXq2wT+4EoohFnmP:gj8fuxR21t5i8f1wh0wnj620EFmaNZ6
TLSH
T1B4B4F012B589C032E5D211314A66CFA25BBE7D388B6695C737C0367E6FB52C29B3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A714.tmp

Path C:\Users\Admin\AppData\Local\Temp\A714.tmp
Size 520KB
SHA256 505db7c0cfd2d3ae31610f5c2c1e9ef13cb12a854b6cbbdbc1079e7feae972c8
MD5 e3a1b95976916101aad2250b729601a0
SHA1 2a6468c0df89dc974a3b01ba07bab35c3a877984
SHA512 7340c53f09c33e75d1b2a14f3443eab6ac8759515ad4e988b9f86b2413024707aa7db07749a3959f109ed286d15a34db85958b56ab09ad043839c0c776400ec0
SSDEEP 12288:gj8fuxR21t5i8fHhII617A4bBEoFXdD/GBAoU5kNZ6:gj8fuK1GYHw17pbJdDuBA95kNI
TLSH
T17EB4F1117545C032E9D205310A26DBA55BBEBD798B26A5C33BC436BE7EB52C2DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A7B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\A7B0.tmp
Size 520KB
SHA256 e563d297d7af06b045b64eb6d1d526dc2f31d991602c653ad3162dd4ce536fdc
MD5 b794b2d5b9efce8485f7a33681885937
SHA1 ad7843a05b55024288c557006d9db18be6987610
SHA512 644bb11647e5e5cc2e4e8a21b02669598d037fa3556a9c346e79e533148f5b125fd91242bf43b776de79792f4373eda262b8f71193dfe8c03342b4d02c82f1f1
SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkb3bOj6qhDVMbymHZsEK4A+K6M9GHHOT9JH:gj8fuxR21t5i8fFWuMhU+KJCHMuNZ6
TLSH
T105B4F122B949C032E9D625314A22DBA117BE7D749B3295C73BC436BD6FB42D1E73430A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A84C.tmp

Path C:\Users\Admin\AppData\Local\Temp\A84C.tmp
Size 520KB
SHA256 66253563d22646813802b434bdabe332067d6f953ae358f27e4478b126cc8f6a
MD5 1277955095ddb24fa974d766a186a8a8
SHA1 f105005dde199b4d26029466c02c87d40ad50035
SHA512 b40e1b6607cb5522a5985a2ca41df85ac17cb1543eac02e80179191aeb7b16dceb39a6b04d959b32e29a5b34019210db4f7add60325fd7726f3daf07b834774f
SSDEEP 12288:gj8fuxR21t5i8fo5zVQKx7au+8nhePLuE7TNZ6:gj8fuK1GYo5z+ahId7TNI
TLSH
T16CB4F012B484C032E9E606304B56CBA54BBE7D759B2696C77BC0366C6FB57C1DA3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A965.tmp

Path C:\Users\Admin\AppData\Local\Temp\A965.tmp
Size 520KB
SHA256 417714cb3ba6cfb2b6f468cd3840b051547071222b071cb57106cb91c4a754ea
MD5 31dca52117c0e7c2f3e4ce33c72f8fc5
SHA1 fb3a5b5b858cc311e0b15ce66ec642bb5c5301ed
SHA512 1238ffa0c9d357fdaa3c32c936856297485b9904e4bccb41c060abe9ab609fcc94b383e4d1369b02f0f81872b5d4e133a07e33d7749e778b3a7999e97780fa42
SSDEEP 12288:gj8fuxR21t5i8fMfizOJMhYFx/Joozj3rkprNZ6:gj8fuK1GYMSOmhY3P3YprNI
TLSH
T10CB4F112B548C033E5D215344A66DB620AFE7D755B2595CB3BC432AE6FB43D2EA3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AA40.tmp

Path C:\Users\Admin\AppData\Local\Temp\AA40.tmp
Size 520KB
SHA256 82b050b20fe7c07d7dd8e6a31a458667db734db7efc541faef5214d53d800de5
MD5 96922d4143ac70f364707ee3ccdb8fff
SHA1 c1a6206750d42aaaf55da4ac660148eb1b178e59
SHA512 07313eb1782ea179f28bc7eb91765146afef75f4b26fe3e3aca9e2fed9df12ac832790d2db379cc8a9ed8dd9200cdf4065d202549363a1a332bfa18bfe30dcd9
SSDEEP 12288:gj8fuxR21t5i8fGdAYtVfBjI9uHTH60EQ31uQ9wkrrNZ6:gj8fuK1GYGdAYXpI9E+G1uQaarNI
TLSH
T1C1B4F112B945C032E8E215314A56DB620BBE7D35973AD5C73B843B6D6FB02D1EA3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AB0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\AB0B.tmp
Size 520KB
SHA256 9afc182400e1e942541d6a9b3ab7627719ccaae0e18bb5fbd111bab3875fb5f0
MD5 021f006b56d75243d6b59f2939f249e2
SHA1 a80ef0e25fae7d32e1da3831c43c661e896a1e14
SHA512 84580e5cf2e3fcad24d0148a178ca4306892788afa24c6e0adbe2f835140db0bcaa0ccb0c141504240ee72175b75cb0e65e89563b3a0df93ef77171429f197e9
SSDEEP 12288:gj8fuxR21t5i8f3aTc96i1IF+xel2HNZ6:gj8fuK1GY3yVi7xe+NI
TLSH
T199B4F1127588C036E9D716314B66CBA10B7E7C399B3695C73B803A6E6FB52C1D63831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AC24.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC24.tmp
Size 520KB
SHA256 3d40f4d30e0bedb5d27166434746c9f24172d31bfc07de2caceca5300340ba27
MD5 ea6fb08a49d605d226f2822c22ed8960
SHA1 b9ccc92bb2054660f7ed7047069098eb345e4224
SHA512 8478450bc574382c92f915a11c0b5bed99c40f5055237389d86d6e386fa4d9cba3102d8a46b145124c999742a9664d86e258a94c8c46e6f5dc1a541c3ac0bb7c
SSDEEP 12288:gj8fuxR21t5i8fbTuRKLr8N3avCCz/jT1qANZ6:gj8fuK1GYbTuYUNcvrT1qANI
TLSH
T1A1B4F112B945C032E99605304B25DBA20BBE7D759B3695C33BC435BDAEB52D1E73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\ACFF.tmp
Size 520KB
SHA256 61b58d226277a41004332491834a69bdf6393146b9a3db3c9ce405c136fe5674
MD5 727d5c0c0864fede1169a78977f88145
SHA1 10f59a0e2b5782f6e96f5fb22fe746838583d79e
SHA512 787540f8618de3e3cde8c95918ca8ed38f0972cb0dd9e6810962342e571ecf276d826274e73f7dd3dddb5be82e3d476496b38ed9681b48b9ada009916dcb52c1
SSDEEP 12288:gj8fuxR21t5i8fL2ni1OgQiby9L9etCC8S1xSSTEPiNZ6:gj8fuK1GYL0gQ8y9L9Li17E6NI
TLSH
T183B4F122B848C032E9A214304B66DFA64BBF7D755B2695C737D036AE6FB52C1D63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\ADBB.tmp
Size 520KB
SHA256 7c95f8de7f9cb344ea5427fa042c604fdbf6de4519847c8866a9ced92ebf1f4b
MD5 8525feedbca55be6efeed1401738ed7b
SHA1 d51af5e94a19f040dab2f6a3b8d232ee09763392
SHA512 07c93a8470a521964a03679eb98a1e6900f5a9f99eb99ad69ce7ea2aa47232f2ec2357c2b74ae52c35342a052f58fadd7c175e3aefd6ac089790c7c60e92eded
SSDEEP 12288:gj8fuxR21t5i8fscBNnbx6sh7X3yX/13mtCxRNZ6:gj8fuK1GYs+dbx5X3yX93mtCbNI
TLSH
T103B4F112B945C032E5D615319A6ACBA10BBEBD399B3A95C33BC4357D2FB42D1D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AED4.tmp

Path C:\Users\Admin\AppData\Local\Temp\AED4.tmp
Size 520KB
SHA256 7901eee5749f81ac0075ca9e62a2fb5048b42a3fdb2e3c0291c153ca664e4f70
MD5 620e269e368a3b9d71bca0c4df402758
SHA1 5416f3a6e9db860896cd2f3ea6e50cfc45ac1cb0
SHA512 1f01c6ccec534986e8fc9dac62ea9ca5abe7c4d65731c90975f10b20a68b9402e43c4a3ac2f81505185ba14c768ebd954a91e020473226623816e0fb640d9042
SSDEEP 12288:gj8fuxR21t5i8ff2EF7MXNHF1zgjXxwxychotZQNZ6:gj8fuK1GY+EF7QNHFpg1w0tONI
TLSH
T165B4F1127649C032E9D219314A62DBA51BBEBD744B36D5C73BC43A6E2FB12C1973830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AFED.tmp

Path C:\Users\Admin\AppData\Local\Temp\AFED.tmp
Size 520KB
SHA256 f143a12879e6137ab64f577ed1e05101a88c0664fcc9f93e050a3d5ba84f7d1a
MD5 6d41c96dcb9eec89e6dd6d41bf056fab
SHA1 243f5d7d56bd5281ef463cf32a891ecde0f65c11
SHA512 d846f0a23571f447c5c6225895554315988f5eeff45859b69a080972ea6c946e4daa028750bb101027d87c82ed1a25dbf691d594afcbe8af8106bbc5c9471241
SSDEEP 12288:gj8fuxR21t5i8fSjY4TKFal0TLO8jKAlr+XNZ6:gj8fuK1GYS9gLdjZlr+XNI
TLSH
T1E4B4F112B989C033E5E319340B16DBA20BBE7C795B2594C77B80366D6FB52D1A73930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B106.tmp

Path C:\Users\Admin\AppData\Local\Temp\B106.tmp
Size 520KB
SHA256 5b7308b46cdde7154ea23a4f1b1238f6242f881f753f9d5f2b1da0c46ee49cf4
MD5 a4d397b91c8d251fbb71a2812f5af6f7
SHA1 f67d0125db7539aaf2ed1aa95d53a01df3b458b2
SHA512 0a8aa1b9b970503511fccb9d4bebbce6b03cf747262bb7bce8c97a82a3d326da4e72b3cca013f4e26e14ada5c9c8ec283b2bd2546a888dedee76591654446736
SSDEEP 12288:gj8fuxR21t5i8fwrHAkBYs8tAvUCWQVr1z4hQ4NZ6:gj8fuK1GYwrHltqAv/R0hdNI
TLSH
T1D0B4F1127989C036E9D301314B26DB610BBABC395B2695C73BC436BD6FB52C1E63871B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1F1.tmp
Size 520KB
SHA256 9ce1c5e9c02203548cf300a57eca5a547b39ef70b51d044f735e38f90616b0c3
MD5 d78d4f260af215b4bb05751ccf00aad6
SHA1 8463fe19298a7321b537566a62ce64ca3e9ab3cd
SHA512 22389a8b0b68c3b8422ef56e04bec0e4dddbdf655b2788469304518f3042027d2da54a878990269858aba51025881be7e5799d6cc82b391b30a5930f1fe5569a
SSDEEP 12288:gj8fuxR21t5i8fZ7254UTIqyG/u2qRNZ6:gj8fuK1GYZ72qUvT/u2qNI
TLSH
T1B1B4F1227984C032E5E215314B52CBA14BBEBD799B2692C73BC0366D6FB52C1D77831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B2FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\B2FA.tmp
Size 520KB
SHA256 a6ffc5e9888df9975e615d8bfc4aa9cdb05b0e9ff6ad540b81b12e9a73ea09b1
MD5 ad9e9181080e391d491eb3ca3d596fe2
SHA1 7757d5418339f66c527bdb7d373f57f5b13c4828
SHA512 ef770cbddd75f746111ca7fc8870cb216c87ed11d2b0fdf7695a784e2a6997071b62623f36b4faee5d2da8bb1452d17fecfdb6477ce2d25978a56b00c641e9b1
SSDEEP 12288:gj8fuxR21t5i8f3Z4bnvQnYaq+0/mMjEW7MH6JC2lfHKJtmNZ6:gj8fuK1GYp4bYnYf+akiC2tq3mNI
TLSH
T167B4F011B944C036E8D611314A96DB6517BEBD368B7696C33BD036AE6FB12C1D73830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B3B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\B3B6.tmp
Size 520KB
SHA256 2a15153734314fc1d2d7b6b5c04251eb350db9f94e14796abb08f3d34f78b900
MD5 c98b71897e85716b05f0b6b60039a512
SHA1 87c60658c616c835b70feadfffad6c97e94942d6
SHA512 f32e5ccec6b8df010ad533387c6fbfae559d0f6a5a83cce93c442f13280d233d6242ba53c02a35fe6df1515ee2fe34b6771da35a626a5cd77f22f47deefb036c
SSDEEP 12288:gj8fuxR21t5i8fQYeRV7mqABIMwclRSNZ6:gj8fuK1GYQYeRVlABXwqoNI
TLSH
T18EB4F112B585C033E9D215354F52DBA14ABE7D7A9B7685C33B8036AD6FB52C0DA3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B4A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\B4A0.tmp
Size 520KB
SHA256 5465fca2ca565848294b918c993b616c4c51adb29de1cf5957fa929e08579a91
MD5 5ad505f73babc73ad503ce132f2bbe5b
SHA1 3bd627462e7d8fcf8f53e5d106245f2c8d52426b
SHA512 1c07d55e21fa69540557f38c91e0065b485fa90cc2439a3f458a2a7ed1a7d17c9b005901b7da0e5db563681fa4093a59294189c5355bc47ad308d950ea3c86d8
SSDEEP 12288:gj8fuxR21t5i8faUVk/taP/stNxkhR3kDoXqK6poPD2mNZ6:gj8fuK1GYabkPIxk33k6WoPDBNI
TLSH
T1F9B4F022B448C032E9E701314B92DBA10BBF7D79877595CB3BC42A6D6EB03D1963835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B58B.tmp

Path C:\Users\Admin\AppData\Local\Temp\B58B.tmp
Size 520KB
SHA256 a6675629fa9aab2da2ed5232b4ba0475a6428f593e09c486cfa42d002dc58109
MD5 e8c11392d8f168c46e7152d4563fbc39
SHA1 fd061200d6e1083ce059f7ed05974aee10232ef5
SHA512 fa820b99db31bbd5d3caf342ce57d2906e35a81b1e92c3bf6e4eb0919dfb66143f07d526276704134a4779d67418354e10ad4cf048e9f538f705667c73ea541e
SSDEEP 12288:gj8fuxR21t5i8fszYvSiy2IdxWBvb95NZ6:gj8fuK1GYxSip1j95NI
TLSH
T19DB4F111B985C432E5D205314B52DBA20BBE7D394B36A1C73BD43A7E6FB52D19A3830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B685.tmp

Path C:\Users\Admin\AppData\Local\Temp\B685.tmp
Size 520KB
SHA256 38d362baa1a773660f891747a2339422cd19fe3ef0acae891a6b437710928a50
MD5 43b0a8a39fd5fe6715c7910bb3d605dd
SHA1 b05e95b0aea52f2b2111d2b829969c0fd752e439
SHA512 7495097ebf0a6979f356a31754a66ae0b1caeb6480a1dae33601ddd88e8f7a9a2557fa63c2d0d76b2a84a63d86b5fb44e9fa1e53504c44f97c64a0587b5bfc65
SSDEEP 12288:gj8fuxR21t5i8fK9OOznTVnODy9DVMVqN6DNZ6:gj8fuK1GYK0GnhXI7DNI
TLSH
T16DB4F112B444C033E99215350A62DBA117BABC79AB3A95C77BC036BD6FB52D1D63830F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B731.tmp

Path C:\Users\Admin\AppData\Local\Temp\B731.tmp
Size 520KB
SHA256 64829afc70093e1fcd037c34ae173c04fc5ed52c572dee0478b47ee089ea2753
MD5 b8e1bfda1cf99717c642a389d02d29f2
SHA1 027f5aa07afe29e1b55c9e8dcace5c64255ec200
SHA512 11d936abab6fcd22597873151a918357846238b8b9b7ac8a0710ae30e3358749f0a126cc72db57f63f4b9d9f3143cb727a55bead2b464f4844e730e870132ba5
SSDEEP 12288:gj8fuxR21t5i8fBs3Rb20yK7IgoLM+ISeqpKxzNZ6:gj8fuK1GYm3p2VTgoIEeqpKxzNI
TLSH
T158B4F112B949C032E9D215318B66DB651BBE7E78573598C33BC436BD6EB42C0E63930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B83A.tmp

Path C:\Users\Admin\AppData\Local\Temp\B83A.tmp
Size 520KB
SHA256 dd7f78ae14b51d6abf4bc4d455e2d612f5f6cdaf85ad6b24a412232ab979c46d
MD5 3e03bc6bf0b5a814a4ee626215160362
SHA1 798bd73f159ff891d8f3395b088cf059d2e0c511
SHA512 de422facdba82748cbac77a985b0d96ffb4f6fca9ba909ccd27465b56fd83a64df1beef52848fd5e6b3b10768bc7596dafa9d987260617ad3b395527a039e111
SSDEEP 12288:gj8fuxR21t5i8fXKEyXsnVD7p9FfYIerrkwKAOLuiNZ6:gj8fuK1GY6ExB7pFcpKPuiNI
TLSH
T16BB4F0117885C033E9D604304B62DBA10BBF7D799B3695C33B8126AEAEB56D1D73831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B915.tmp

Path C:\Users\Admin\AppData\Local\Temp\B915.tmp
Size 520KB
SHA256 f718e05a7f9d18858fbd864e3479f4088eaca3cd7d7d52123b0f90c1df815f51
MD5 4b60d8caa42c7317b42835a8c5ae83bc
SHA1 725725acb15aa7d7456e0dcdbc5125340082ac9e
SHA512 dd4e11a7e7b2d50e01c8e8eb2826f107bed66780100e53c95cf96fe4c98f2923309d2c05e99f149e422b63dfa97a62440c3dbf472df6aa047debdd842f191f8a
SSDEEP 12288:gj8fuxR21t5i8fjQujh0zVkIBCkPojj5lOfYahGdNZ6:gj8fuK1GYj1gGrODGdNI
TLSH
T1A0B40112B989C032E9D205304A52DBA20BBE7D798B3695C73BD4366D6FB16D0D77830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B9E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\B9E0.tmp
Size 520KB
SHA256 5498d312b70674f3c147f86112cb42d2761b949a32b923357ee6c204f314e87b
MD5 93c1c4a150e227c804c25932210b0ce1
SHA1 1678bcc55d8f0e6c850fe6b9277597086fd2faff
SHA512 b44996dad2122982f232d9b2993ed86224e6d3a143e218b8cf0cc141a49ece9e9f57533dfacc478761edaa7fcf3520779cd8125d9727986d1333e8a0d42ccfdf
SSDEEP 12288:gj8fuxR21t5i8f2MSWfvNl7JiwMWoHVBQLIdONNZ6:gj8fuK1GY2MTN90rWSQXNNI
TLSH
T19EB4F0017984C036E89305310B61DBA11BBEBC399B2695C777843A7D6EF62D2E77930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads