6db5995e0dfb34012e7440cd4661db614bcce5928add267b97942ea7de889bc3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_2bac5469759e04161086c9c59c40dd68_elex_mafia_poet-rat_stealc_tofsee.exe
Size 3.6MB
Sample260820-h33fjaca73
SHA256 6db5995e0dfb34012e7440cd4661db614bcce5928add267b97942ea7de889bc3
MD5 2bac5469759e04161086c9c59c40dd68
SHA1 6dd202c84375630f6b07c4f01de0dfa7bb90a905
SHA512 94126c2afa853c2d0cc73e083dbb69aa5a882e1bd4c42e49fa30794f223702356a296bd2cbe21ca07c1f4fb616c5669defa01c0e73a2c075530a62252eb0d3a3
SSDEEP 49152:w/OJD3VmypMNGEADt7i+/yTukuFGNLrkBirx:EOLmchrSiGdkBirx
TLSH
T1CD06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2388	FB34.tmp
5556	FC1E.tmp
4228	FF3B.tmp
1612	15E.tmp
3312	2D5.tmp
4668	7A7.tmp
1592	A76.tmp
3344	D35.tmp
1576	1081.tmp
4484	1321.tmp
2444	15E0.tmp
2568	1831.tmp
3004	1B00.tmp
2972	1D71.tmp
8	20BD.tmp
1200	232E.tmp
2572	25CE.tmp
236	2820.tmp
3572	2AA0.tmp
808	2C08.tmp
1384	2FB1.tmp
5376	3270.tmp
1844	3510.tmp
2236	37DF.tmp
3532	3AAE.tmp
1188	3DF9.tmp
3404	40B8.tmp
2316	42FB.tmp
5900	4452.tmp
3588	47EC.tmp
1128	4AF9.tmp
2244	4D99.tmp
4912	5049.tmp
564	5172.tmp
3904	529B.tmp
3972	53C3.tmp
3048	550C.tmp
3924	55F6.tmp
3204	5700.tmp
944	5809.tmp
2512	5990.tmp
4460	5A8A.tmp
5972	5B93.tmp
1412	5C5F.tmp
3296	5D68.tmp
4268	5E91.tmp
476	5FBA.tmp
2496	60B4.tmp
5980	61BE.tmp
4164	6289.tmp
4160	6363.tmp
1432	642F.tmp
5276	64FA.tmp
1180	65D4.tmp
4220	66BF.tmp
3328	67B9.tmp
4100	6874.tmp
5464	695F.tmp
3352	6A49.tmp
5364	6B43.tmp
1364	6C2D.tmp
2476	6CD9.tmp
2472	6DA4.tmp
3448	6E70.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FB1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FB5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3DF9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EEA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D6CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7178.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7437.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65D4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BD2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54B9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B3C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B43E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E0DC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1831.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AA0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	529B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AF61.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B4C0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D0B4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4013.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C82.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4085.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	571A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8166.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2353.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8687.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A411.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC10.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E85E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EF14.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32F3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C8D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7253.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1C2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B339.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD1C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A24C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24F9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BCD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9512.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CD25.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	232E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A965.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D24A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C44B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9F4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3510.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EA9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	957B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A4BD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACFA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	646.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B93.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42C7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9154.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2388	3672	2026-08-20_2bac5469759e04161086c9c59c40dd68_elex_mafia_poet-rat_stealc_tofsee.exe	89
PID 2388 wrote to memory of 5556	2388	FB34.tmp	90
PID 5556 wrote to memory of 4228	5556	FC1E.tmp	91
PID 4228 wrote to memory of 1612	4228	FF3B.tmp	92
PID 1612 wrote to memory of 3312	1612	15E.tmp	93
PID 3312 wrote to memory of 4668	3312	2D5.tmp	94
PID 4668 wrote to memory of 1592	4668	7A7.tmp	95
PID 1592 wrote to memory of 3344	1592	A76.tmp	96
PID 3344 wrote to memory of 1576	3344	D35.tmp	97
PID 1576 wrote to memory of 4484	1576	1081.tmp	98
PID 4484 wrote to memory of 2444	4484	1321.tmp	99
PID 2444 wrote to memory of 2568	2444	15E0.tmp	100
PID 2568 wrote to memory of 3004	2568	1831.tmp	101
PID 3004 wrote to memory of 2972	3004	1B00.tmp	102
PID 2972 wrote to memory of 8	2972	1D71.tmp	103
PID 8 wrote to memory of 1200	8	20BD.tmp	104
PID 1200 wrote to memory of 2572	1200	232E.tmp	105
PID 2572 wrote to memory of 236	2572	25CE.tmp	106
PID 236 wrote to memory of 3572	236	2820.tmp	107
PID 3572 wrote to memory of 808	3572	2AA0.tmp	108
PID 808 wrote to memory of 1384	808	2C08.tmp	109
PID 1384 wrote to memory of 5376	1384	2FB1.tmp	110
PID 5376 wrote to memory of 1844	5376	3270.tmp	111
PID 1844 wrote to memory of 2236	1844	3510.tmp	112
PID 2236 wrote to memory of 3532	2236	37DF.tmp	113
PID 3532 wrote to memory of 1188	3532	3AAE.tmp	114
PID 1188 wrote to memory of 3404	1188	3DF9.tmp	115
PID 3404 wrote to memory of 2316	3404	40B8.tmp	116
PID 2316 wrote to memory of 5900	2316	42FB.tmp	117
PID 5900 wrote to memory of 3588	5900	4452.tmp	118
PID 3588 wrote to memory of 1128	3588	47EC.tmp	119
PID 1128 wrote to memory of 2244	1128	4AF9.tmp	120
PID 2244 wrote to memory of 4912	2244	4D99.tmp	121
PID 4912 wrote to memory of 564	4912	5049.tmp	122
PID 564 wrote to memory of 3904	564	5172.tmp	123
PID 3904 wrote to memory of 3972	3904	529B.tmp	124
PID 3972 wrote to memory of 3048	3972	53C3.tmp	125
PID 3048 wrote to memory of 3924	3048	550C.tmp	126
PID 3924 wrote to memory of 3204	3924	55F6.tmp	127
PID 3204 wrote to memory of 944	3204	5700.tmp	128
PID 944 wrote to memory of 2512	944	5809.tmp	129
PID 2512 wrote to memory of 4460	2512	5990.tmp	130
PID 4460 wrote to memory of 5972	4460	5A8A.tmp	131
PID 5972 wrote to memory of 1412	5972	5B93.tmp	132
PID 1412 wrote to memory of 3296	1412	5C5F.tmp	133
PID 3296 wrote to memory of 4268	3296	5D68.tmp	134
PID 4268 wrote to memory of 476	4268	5E91.tmp	135
PID 476 wrote to memory of 2496	476	5FBA.tmp	136
PID 2496 wrote to memory of 5980	2496	60B4.tmp	137
PID 5980 wrote to memory of 4164	5980	61BE.tmp	138
PID 4164 wrote to memory of 4160	4164	6289.tmp	139
PID 4160 wrote to memory of 1432	4160	6363.tmp	140
PID 1432 wrote to memory of 5276	1432	642F.tmp	141
PID 5276 wrote to memory of 1180	5276	64FA.tmp	142
PID 1180 wrote to memory of 4220	1180	65D4.tmp	143
PID 4220 wrote to memory of 3328	4220	66BF.tmp	144
PID 3328 wrote to memory of 4100	3328	67B9.tmp	145
PID 4100 wrote to memory of 5464	4100	6874.tmp	146
PID 5464 wrote to memory of 3352	5464	695F.tmp	147
PID 3352 wrote to memory of 5364	3352	6A49.tmp	148
PID 5364 wrote to memory of 1364	5364	6B43.tmp	149
PID 1364 wrote to memory of 2476	1364	6C2D.tmp	150
PID 2476 wrote to memory of 2472	2476	6CD9.tmp	151
PID 2472 wrote to memory of 3448	2472	6DA4.tmp	152

C:\Users\Admin\AppData\Local\Temp\2026-08-20_2bac5469759e04161086c9c59c40dd68_elex_mafia_poet-rat_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2bac5469759e04161086c9c59c40dd68_elex_mafia_poet-rat_stealc_tofsee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\FB34.tmp
  "C:\Users\Admin\AppData\Local\Temp\FB34.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\FC1E.tmp
    "C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\FF3B.tmp
      "C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\15E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15E.tmp"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\2D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D5.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\7A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A7.tmp"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\A76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A76.tmp"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\D35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D35.tmp"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\1081.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1081.tmp"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\1321.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1321.tmp"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\15E0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\15E0.tmp"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\1831.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1831.tmp"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\1B00.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B00.tmp"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\1D71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D71.tmp"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\20BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20BD.tmp"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\232E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\232E.tmp"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\25CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25CE.tmp"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\2820.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2820.tmp"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\2AA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\2C08.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C08.tmp"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\2FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\3270.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3270.tmp"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\3510.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3510.tmp"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\37DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\37DF.tmp"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\3AAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\3DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\40B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40B8.tmp"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\42FB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42FB.tmp"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\4452.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4452.tmp"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\47EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\47EC.tmp"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\4AF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\4D99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D99.tmp"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\5049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5049.tmp"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\5172.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5172.tmp"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\529B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\529B.tmp"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\53C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53C3.tmp"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\550C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\550C.tmp"
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\55F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\55F6.tmp"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\5700.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5700.tmp"
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\5809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5809.tmp"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\5990.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5990.tmp"
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\5A8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\5B93.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B93.tmp"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\5C5F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\5D68.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D68.tmp"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\5E91.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E91.tmp"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\5FBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\60B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\60B4.tmp"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\61BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61BE.tmp"
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\6289.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6289.tmp"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\6363.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6363.tmp"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\642F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\642F.tmp"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\64FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64FA.tmp"
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\65D4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\65D4.tmp"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\66BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\66BF.tmp"
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\67B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67B9.tmp"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\6874.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6874.tmp"
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\695F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\695F.tmp"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\6A49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A49.tmp"
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\6B43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B43.tmp"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\6C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\6CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\6DA4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\6E70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E70.tmp"
        65⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\6F3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"
        66⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\7035.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7035.tmp"
        67⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\710F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\710F.tmp"
        68⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\71DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\71DB.tmp"
        69⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\72A6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\72A6.tmp"
        70⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\7361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7361.tmp"
        71⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\742C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\742C.tmp"
        72⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\7517.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7517.tmp"
        73⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\75C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75C3.tmp"
        74⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\766E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\766E.tmp"
        75⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\773A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\773A.tmp"
        76⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\77E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\77E5.tmp"
        77⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\78B1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78B1.tmp"
        78⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\795C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\795C.tmp"
        79⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\7A28.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A28.tmp"
        80⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\7B02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B02.tmp"
        81⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\7BCD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7BCD.tmp"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\7CA8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"
        83⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\7D73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7D73.tmp"
        84⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\7E3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"
        85⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\7EEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\7FB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\8071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8071.tmp"
        88⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\810D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\810D.tmp"
        89⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\81F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\81F8.tmp"
        90⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\82B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82B3.tmp"
        91⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\839D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\839D.tmp"
        92⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\8469.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8469.tmp"
        93⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\8553.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8553.tmp"
        94⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\861E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\861E.tmp"
        95⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\86F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86F9.tmp"
        96⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\87E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\87E3.tmp"
        97⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\888F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\888F.tmp"
        98⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\8989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8989.tmp"
        99⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\8A45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A45.tmp"
        100⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\8B10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B10.tmp"
        101⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\8BCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"
        102⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\8C96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C96.tmp"
        103⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\8D52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D52.tmp"
        104⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\8DFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"
        105⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\8F17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F17.tmp"
        106⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\8FE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"
        107⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\90EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\90EC.tmp"
        108⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\91A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\91A7.tmp"
        109⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\9282.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9282.tmp"
        110⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\936C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\936C.tmp"
        111⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\9437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9437.tmp"
        112⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\9512.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9512.tmp"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\95BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95BE.tmp"
        114⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\967A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\967A.tmp"
        115⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\9745.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9745.tmp"
        116⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\9810.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9810.tmp"
        117⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\98FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98FA.tmp"
        118⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\99E5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99E5.tmp"
        119⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\9AA0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"
        120⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\9B7B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"
        121⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\9C56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C56.tmp"
        122⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\9D11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D11.tmp"
        123⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\9DEC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"
        124⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\9EB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EB7.tmp"
        125⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\9FA1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"
        126⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\A06C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A06C.tmp"
        127⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\A138.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A138.tmp"
        128⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\A212.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A212.tmp"
        129⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\A2BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"
        130⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\A37A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A37A.tmp"
        131⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\A454.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A454.tmp"
        132⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\A55E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A55E.tmp"
        133⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\A639.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A639.tmp"
        134⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\A704.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A704.tmp"
        135⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\A7B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"
        136⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\A88B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A88B.tmp"
        137⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\A965.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A965.tmp"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\AA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA30.tmp"
        139⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\AAFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"
        140⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\ABA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"
        141⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\AC63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC63.tmp"
        142⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\AD1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AD1E.tmp"
        143⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\ADEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"
        144⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\AEB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"
        145⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\AF61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF61.tmp"
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\B01C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B01C.tmp"
        147⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\B0E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"
        148⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\B1C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\B27D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B27D.tmp"
        150⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\B339.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B339.tmp"
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\B3F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"
        152⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\B4C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\B5C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"
        154⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\B685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B685.tmp"
        155⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\B75F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B75F.tmp"
        156⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\B84A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B84A.tmp"
        157⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\B934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B934.tmp"
        158⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\B9D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"
        159⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\BABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BABB.tmp"
        160⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\BB67.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB67.tmp"
        161⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\BC41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BC41.tmp"
        162⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\BD1C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\BDC8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"
        164⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\BEA3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"
        165⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\BF8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"
        166⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\C078.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C078.tmp"
        167⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\C123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C123.tmp"
        168⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\C1EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"
        169⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\C2AA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"
        170⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\C366.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C366.tmp"
        171⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\C421.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C421.tmp"
        172⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\C4DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"
        173⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\C5A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"
        174⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\C673.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C673.tmp"
        175⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\C73E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C73E.tmp"
        176⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\C809.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C809.tmp"
        177⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\C8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"
        178⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\C9AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"
        179⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\CA7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"
        180⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\CB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB55.tmp"
        181⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\CC10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC10.tmp"
        182⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\CCDB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"
        183⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\CDB6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"
        184⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\CE72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE72.tmp"
        185⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\CF3D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"
        186⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\D018.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D018.tmp"
        187⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\D0B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\D17F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D17F.tmp"
        189⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\D24A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D24A.tmp"
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\D306.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D306.tmp"
        191⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\D3C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"
        192⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\D48C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D48C.tmp"
        193⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\D548.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D548.tmp"
        194⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\D603.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D603.tmp"
        195⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\D6CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\D77A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D77A.tmp"
        197⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\D855.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D855.tmp"
        198⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\D930.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D930.tmp"
        199⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\D9DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"
        200⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\DAA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"
        201⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\DB62.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB62.tmp"
        202⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\DC0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"
        203⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\DCCA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"
        204⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\DD95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD95.tmp"
        205⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\DE6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"
        206⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\DF2B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"
        207⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\DFF6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"
        208⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\E0B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"
        209⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\E16D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E16D.tmp"
        210⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\E248.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E248.tmp"
        211⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\E303.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E303.tmp"
        212⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\E3CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"
        213⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\E4A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"
        214⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\E565.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E565.tmp"
        215⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\E63F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E63F.tmp"
        216⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\E6EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"
        217⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\E7B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"
        218⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\E862.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E862.tmp"
        219⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\E92D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E92D.tmp"
        220⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\E9CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"
        221⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Local\Temp\EA76.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA76.tmp"
        222⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\EB41.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB41.tmp"
        223⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\EBED.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBED.tmp"
        224⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\EC98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC98.tmp"
        225⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\ED64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED64.tmp"
        226⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\EE2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"
        227⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\EEEA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"
        228⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\EFA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"
        229⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\F090.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F090.tmp"
        230⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\F12C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F12C.tmp"
        231⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\F226.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F226.tmp"
        232⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\F2E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"
        233⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\F39D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F39D.tmp"
        234⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\F468.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F468.tmp"
        235⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\F514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F514.tmp"
        236⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\F5C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"
        237⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\F65C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F65C.tmp"
        238⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\F747.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F747.tmp"
        239⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\F7E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"
        240⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\F8AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"
        241⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\F989.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F989.tmp"
        242⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\FA54.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA54.tmp"
        243⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\FB10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB10.tmp"
        244⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\FBCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"
        245⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\FC96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC96.tmp"
        246⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\FD71.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD71.tmp"
        247⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\FE0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"
        248⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\FEC9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"
        249⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\FF84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF84.tmp"
        250⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\30.tmp"
        251⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC.tmp"
        252⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\1A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A7.tmp"
        253⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\263.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\263.tmp"
        254⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\32E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32E.tmp"
        255⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\418.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\418.tmp"
        256⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B4.tmp"
        257⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\560.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\560.tmp"
        258⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\61C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61C.tmp"
        259⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\6D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D7.tmp"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\783.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\783.tmp"
        261⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\82F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\82F.tmp"
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\8EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EA.tmp"
        263⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\9B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B6.tmp"
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\A52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A52.tmp"
        265⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\B0D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B0D.tmp"
        266⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\BD8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD8.tmp"
        267⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\C84.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C84.tmp"
        268⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\D30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D30.tmp"
        269⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\DFB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DFB.tmp"
        270⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\EA7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA7.tmp"
        271⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F63.tmp"
        272⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\103D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\103D.tmp"
        273⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\10DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\10DA.tmp"
        274⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\1176.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1176.tmp"
        275⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\1231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1231.tmp"
        276⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\12DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\12DD.tmp"
        277⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\1399.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1399.tmp"
        278⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\1493.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1493.tmp"
        279⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\152F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\152F.tmp"
        280⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\160A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\160A.tmp"
        281⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\16B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16B6.tmp"
        282⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\1781.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1781.tmp"
        283⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\185C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\185C.tmp"
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\18F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\18F8.tmp"
        285⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\19B3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19B3.tmp"
        286⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\1A7E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"
        287⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\1B2A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"
        288⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\1BE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"
        289⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\1C82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C82.tmp"
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\1D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"
        291⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\1DE9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"
        292⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\1E95.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E95.tmp"
        293⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\1F60.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F60.tmp"
        294⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\202C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\202C.tmp"
        295⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\20E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\20E7.tmp"
        296⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\21B2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21B2.tmp"
        297⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\225E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\225E.tmp"
        298⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\2329.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2329.tmp"
        299⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\23F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23F4.tmp"
        300⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\24A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24A0.tmp"
        301⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\257B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\257B.tmp"
        302⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\2627.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2627.tmp"
        303⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\26C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26C3.tmp"
        304⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\278E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\278E.tmp"
        305⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\282A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\282A.tmp"
        306⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\28D6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\28D6.tmp"
        307⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\2982.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2982.tmp"
        308⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\2A3E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"
        309⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\2B09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B09.tmp"
        310⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\2BC4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"
        311⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\2C70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C70.tmp"
        312⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\2D5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"
        313⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\2E06.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E06.tmp"
        314⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\2EE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"
        315⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\2F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"
        316⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\3049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3049.tmp"
        317⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\3104.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3104.tmp"
        318⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\31A0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31A0.tmp"
        319⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\325C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\325C.tmp"
        320⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\3317.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3317.tmp"
        321⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\33D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33D3.tmp"
        322⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\34AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34AE.tmp"
        323⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\3569.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3569.tmp"
        324⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\3615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3615.tmp"
        325⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\36C1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\36C1.tmp"
        326⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\377C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\377C.tmp"
        327⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\3828.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3828.tmp"
        328⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\38E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38E4.tmp"
        329⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\399F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\399F.tmp"
        330⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\3A4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"
        331⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\3B07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B07.tmp"
        332⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\3BD2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\3C8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C8D.tmp"
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\3D58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D58.tmp"
        335⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\3E23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E23.tmp"
        336⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\3EFE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EFE.tmp"
        337⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\3FBA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"
        338⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\4085.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4085.tmp"
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\4131.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4131.tmp"
        340⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\41FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\41FC.tmp"
        341⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\42C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\42C7.tmp"
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\4382.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4382.tmp"
        343⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\444E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\444E.tmp"
        344⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\4509.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4509.tmp"
        345⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\45C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\45C5.tmp"
        346⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\4680.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4680.tmp"
        347⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\475B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\475B.tmp"
        348⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\4836.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4836.tmp"
        349⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\48C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\48C2.tmp"
        350⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\497E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\497E.tmp"
        351⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\4A39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4A39.tmp"
        352⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\4AF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"
        353⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\4BB0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"
        354⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\4C6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"
        355⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\4D27.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4D27.tmp"
        356⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\4E02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4E02.tmp"
        357⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\4EDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"
        358⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\4F79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F79.tmp"
        359⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\5044.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5044.tmp"
        360⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\5100.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5100.tmp"
        361⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\51BB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\51BB.tmp"
        362⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\5277.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5277.tmp"
        363⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\5342.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5342.tmp"
        364⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\53FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\53FD.tmp"
        365⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\54B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\54B9.tmp"
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\5565.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5565.tmp"
        367⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\5610.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5610.tmp"
        368⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\571A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\571A.tmp"
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\57B6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\57B6.tmp"
        370⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\58C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58C0.tmp"
        371⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\596C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\596C.tmp"
        372⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\5A37.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A37.tmp"
        373⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\5B21.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5B21.tmp"
        374⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\5C0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"
        375⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\5CB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"
        376⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\5D73.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D73.tmp"
        377⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\5E5D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"
        378⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\5F48.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5F48.tmp"
        379⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\6042.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6042.tmp"
        380⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\611D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\611D.tmp"
        381⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\61F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\61F7.tmp"
        382⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\62C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\62C2.tmp"
        383⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\638E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\638E.tmp"
        384⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\6478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6478.tmp"
        385⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\6543.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6543.tmp"
        386⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\661E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\661E.tmp"
        387⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\6718.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6718.tmp"
        388⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\6812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6812.tmp"
        389⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\68DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68DD.tmp"
        390⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\69B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\69B8.tmp"
        391⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\6A92.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A92.tmp"
        392⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\6B6D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6B6D.tmp"
        393⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\6C38.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6C38.tmp"
        394⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\6D23.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6D23.tmp"
        395⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\6DBF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"
        396⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\6EA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\6F74.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F74.tmp"
        398⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\706E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\706E.tmp"
        399⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\7178.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7178.tmp"
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\7253.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7253.tmp"
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\733D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\733D.tmp"
        402⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\7437.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7437.tmp"
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\74F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74F3.tmp"
        404⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\75CD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75CD.tmp"
        405⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\76A8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\76A8.tmp"
        406⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\7B3C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\7C07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C07.tmp"
        408⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\7CF2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"
        409⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\7DDC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7DDC.tmp"
        410⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\7EC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"
        411⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\7FB1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"
        412⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\808B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\808B.tmp"
        413⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\8166.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8166.tmp"
        414⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\8222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8222.tmp"
        415⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\830C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\830C.tmp"
        416⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\83F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\83F6.tmp"
        417⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\84C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\84C2.tmp"
        418⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\85AC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\85AC.tmp"
        419⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\8687.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8687.tmp"
        420⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\8742.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8742.tmp"
        421⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\880D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\880D.tmp"
        422⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\88F8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\88F8.tmp"
        423⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\89C3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\89C3.tmp"
        424⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\8A8E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"
        425⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\8B88.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8B88.tmp"
        426⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\8C63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8C63.tmp"
        427⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\8D2E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"
        428⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\8DF9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DF9.tmp"
        429⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\8EB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"
        430⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\8F70.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8F70.tmp"
        431⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\904B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\904B.tmp"
        432⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\9154.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9154.tmp"
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\923F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\923F.tmp"
        434⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\92EB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\92EB.tmp"
        435⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\93C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\93C5.tmp"
        436⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\94BF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\94BF.tmp"
        437⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\957B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\957B.tmp"
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\9665.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9665.tmp"
        439⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\9740.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9740.tmp"
        440⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\980B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\980B.tmp"
        441⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\98B7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\98B7.tmp"
        442⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\99A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99A1.tmp"
        443⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\9A6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"
        444⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\9B57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9B57.tmp"
        445⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\9BF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9BF3.tmp"
        446⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\9CDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"
        447⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\9DB8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"
        448⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\9E64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E64.tmp"
        449⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\9F4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"
        450⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\A00A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A00A.tmp"
        451⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\A0C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A0C5.tmp"
        452⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\A191.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A191.tmp"
        453⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\A24C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A24C.tmp"
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\A336.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A336.tmp"
        455⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\A411.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A411.tmp"
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\A4BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A4BD.tmp"
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\A598.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A598.tmp"
        458⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\A663.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A663.tmp"
        459⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\A74D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A74D.tmp"
        460⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\A7F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A7F9.tmp"
        461⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\A8E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8E4.tmp"
        462⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\A99F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A99F.tmp"
        463⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\AA5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA5B.tmp"
        464⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\AB55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AB55.tmp"
        465⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\AC10.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC10.tmp"
        466⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\ACFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ACFA.tmp"
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\AE04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AE04.tmp"
        468⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\AECF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AECF.tmp"
        469⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\AF8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF8B.tmp"
        470⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\B046.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B046.tmp"
        471⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\B111.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B111.tmp"
        472⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\B1BD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1BD.tmp"
        473⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\B279.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B279.tmp"
        474⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\B353.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B353.tmp"
        475⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\B43E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B43E.tmp"
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\B509.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B509.tmp"
        477⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\B5E4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B5E4.tmp"
        478⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\B6AF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6AF.tmp"
        479⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\B74B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B74B.tmp"
        480⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\B807.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B807.tmp"
        481⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\B8E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B8E1.tmp"
        482⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\B99D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B99D.tmp"
        483⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\BA58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BA58.tmp"
        484⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\BB14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB14.tmp"
        485⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\BBC0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BBC0.tmp"
        486⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\BCAA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCAA.tmp"
        487⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\BD66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BD66.tmp"
        488⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\BE11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BE11.tmp"
        489⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\BEFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BEFC.tmp"
        490⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\BF98.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF98.tmp"
        491⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\C073.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C073.tmp"
        492⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\C13E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C13E.tmp"
        493⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\C1EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C1EA.tmp"
        494⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\C296.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C296.tmp"
        495⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\C361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C361.tmp"
        496⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\C44B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C44B.tmp"
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\C516.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C516.tmp"
        498⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\C5C2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5C2.tmp"
        499⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\C65E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C65E.tmp"
        500⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\C72A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C72A.tmp"
        501⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\C7D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C7D5.tmp"
        502⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\C8A1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C8A1.tmp"
        503⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\C95C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C95C.tmp"
        504⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\CA18.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CA18.tmp"
        505⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\CAE3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE3.tmp"
        506⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\CBAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CBAE.tmp"
        507⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\CC5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC5A.tmp"
        508⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\CD25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CD25.tmp"
        509⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\CDE0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CDE0.tmp"
        510⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\CEAB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CEAB.tmp"
        511⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\CF96.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF96.tmp"
        512⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\D071.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D071.tmp"
        513⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\D11C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D11C.tmp"
        514⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\D1E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D1E8.tmp"
        515⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\D284.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D284.tmp"
        516⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\D37E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D37E.tmp"
        517⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\D459.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D459.tmp"
        518⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\D514.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D514.tmp"
        519⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\D5DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5DF.tmp"
        520⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\D68B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D68B.tmp"
        521⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\D756.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D756.tmp"
        522⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\D812.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D812.tmp"
        523⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\D8FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D8FC.tmp"
        524⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\D9B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D9B8.tmp"
        525⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\DA63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DA63.tmp"
        526⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\DB2F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB2F.tmp"
        527⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\DBFA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DBFA.tmp"
        528⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\DCB5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DCB5.tmp"
        529⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\DD90.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD90.tmp"
        530⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\DE4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DE4B.tmp"
        531⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\DF55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF55.tmp"
        532⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\E020.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E020.tmp"
        533⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\E0DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E0DC.tmp"
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\E197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E197.tmp"
        535⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\E243.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E243.tmp"
        536⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\E31E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E31E.tmp"
        537⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\E3D9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E3D9.tmp"
        538⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\E4B4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"
        539⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\E550.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E550.tmp"
        540⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\E62B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E62B.tmp"
        541⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\E6D7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E6D7.tmp"
        542⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\E7A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7A2.tmp"
        543⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\E85E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E85E.tmp"
        544⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\E929.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E929.tmp"
        545⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\E9F4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E9F4.tmp"
        546⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\EAAF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EAAF.tmp"
        547⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\EB5B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EB5B.tmp"
        548⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\EC17.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EC17.tmp"
        549⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\ECC3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ECC3.tmp"
        550⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\ED6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED6E.tmp"
        551⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\EE3A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE3A.tmp"
        552⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\EF14.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EF14.tmp"
        553⤵
        System Location Discovery: System Language Discovery
        
        PID:120
        
        C:\Users\Admin\AppData\Local\Temp\EFFF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFFF.tmp"
        554⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\F09B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F09B.tmp"
        555⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\F156.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F156.tmp"
        556⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\F231.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F231.tmp"
        557⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\F2DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F2DD.tmp"
        558⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\F3B8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F3B8.tmp"
        559⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\F483.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F483.tmp"
        560⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\F51F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F51F.tmp"
        561⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\F5CB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F5CB.tmp"
        562⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\F677.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F677.tmp"
        563⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\F732.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F732.tmp"
        564⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\F7CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F7CF.tmp"
        565⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\F8A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8A9.tmp"
        566⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\F955.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F955.tmp"
        567⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\FA30.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FA30.tmp"
        568⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\FADC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FADC.tmp"
        569⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\FB78.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FB78.tmp"
        570⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\FC43.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FC43.tmp"
        571⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\FCEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FCEF.tmp"
        572⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\FD9B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FD9B.tmp"
        573⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\FE66.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FE66.tmp"
        574⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\FF22.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FF22.tmp"
        575⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\FFCE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\FFCE.tmp"
        576⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\99.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\99.tmp"
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\145.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\145.tmp"
        578⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\210.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\210.tmp"
        579⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\2DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DB.tmp"
        580⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\377.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\377.tmp"
        581⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\413.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\413.tmp"
        582⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\4DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DE.tmp"
        583⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\58A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\58A.tmp"
        584⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\646.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\646.tmp"
        585⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\6F2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F2.tmp"
        586⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\79E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\79E.tmp"
        587⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\878.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\878.tmp"
        588⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\934.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\934.tmp"
        589⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\9EF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9EF.tmp"
        590⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\A8C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A8C.tmp"
        591⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\B57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B57.tmp"
        592⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\C03.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C03.tmp"
        593⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\CAE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CAE.tmp"
        594⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\D3B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D3B.tmp"
        595⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\E25.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E25.tmp"
        596⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\EE1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE1.tmp"
        597⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\F8D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F8D.tmp"
        598⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\1068.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1068.tmp"
        599⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\1123.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1123.tmp"
        600⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\11CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11CF.tmp"
        601⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\129A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\129A.tmp"
        602⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\1356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1356.tmp"
        603⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\1401.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1401.tmp"
        604⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\14AD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14AD.tmp"
        605⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\1559.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1559.tmp"
        606⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\1615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1615.tmp"
        607⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\16D0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\16D0.tmp"
        608⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\178C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\178C.tmp"
        609⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\1847.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1847.tmp"
        610⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\1912.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1912.tmp"
        611⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\19DD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\19DD.tmp"
        612⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\1AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AA9.tmp"
        613⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\1B64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1B64.tmp"
        614⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\1C20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C20.tmp"
        615⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\1CEB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1CEB.tmp"
        616⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\1DA6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DA6.tmp"
        617⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\1E52.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1E52.tmp"
        618⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\1F0E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F0E.tmp"
        619⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\1FB9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1FB9.tmp"
        620⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\2065.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2065.tmp"
        621⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\2121.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2121.tmp"
        622⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\21EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\21EC.tmp"
        623⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\22A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\22A7.tmp"
        624⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\2353.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2353.tmp"
        625⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\241E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\241E.tmp"
        626⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\24F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\24F9.tmp"
        627⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\25A5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\25A5.tmp"
        628⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\2651.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2651.tmp"
        629⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\26FD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\26FD.tmp"
        630⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\27A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\27A9.tmp"
        631⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\2883.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2883.tmp"
        632⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\294F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\294F.tmp"
        633⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\2A0A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2A0A.tmp"
        634⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\2AD5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AD5.tmp"
        635⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\2B81.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2B81.tmp"
        636⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\2C2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C2D.tmp"
        637⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\2CD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2CD9.tmp"
        638⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\2D94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2D94.tmp"
        639⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\2E6F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2E6F.tmp"
        640⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\2F1B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F1B.tmp"
        641⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\2FE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"
        642⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\3092.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3092.tmp"
        643⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\315D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\315D.tmp"
        644⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\3209.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3209.tmp"
        645⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\32F3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\32F3.tmp"
        646⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\33BE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\33BE.tmp"
        647⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\346A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\346A.tmp"
        648⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\3516.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3516.tmp"
        649⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\35E1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\35E1.tmp"
        650⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\368D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\368D.tmp"
        651⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\3739.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3739.tmp"
        652⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\3814.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3814.tmp"
        653⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\38C0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38C0.tmp"
        654⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\398B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\398B.tmp"
        655⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\3A56.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A56.tmp"
        656⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\3B02.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3B02.tmp"
        657⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\3BDD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BDD.tmp"
        658⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\3C79.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3C79.tmp"
        659⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\3D63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D63.tmp"
        660⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\3DF0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3DF0.tmp"
        661⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\3EBB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3EBB.tmp"
        662⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\3F57.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F57.tmp"
        663⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\4013.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4013.tmp"
        664⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\40CE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\40CE.tmp"
        665⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\4199.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4199.tmp"
        666⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\4255.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4255.tmp"
        667⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\4301.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4301.tmp"
        668⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\43DB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\43DB.tmp"
        669⤵
        
        PID:6696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1081.tmp

Path C:\Users\Admin\AppData\Local\Temp\1081.tmp
Size 3.6MB
SHA256 04acb91389332250edba8a32587391dda71870ddecc046a758345e82a9d37179
MD5 1e531a0d2a013a5d910031fbc7de6791
SHA1 2a943870d54fe3069c3c3ded071ed647239d45f0
SHA512 7fd8b6b38f37246f0498125f2162fee49145028de25e599a10f0fece84695610a958a585cbb5cfae2109d7221ffcbde2759c109cba7d78ef68fb2198b523fef9
SSDEEP 49152:w/OJDoHpmNGEADt7i+/yTukuFGNLrkBirx:EOamchrSiGdkBirx
TLSH
T17906831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1321.tmp

Path C:\Users\Admin\AppData\Local\Temp\1321.tmp
Size 3.6MB
SHA256 cd62d15d31787b22962ce179ee13ccd44cd36e523c6b59ba421db2086b1b0f30
MD5 da82020301a4b4b8b385d801274add9a
SHA1 037d172d1ebc0480e4093fdb90a63500bfc9f6ea
SHA512 6fb65ded7f5d151b01adb6d4fb86af58625cf6ad012cbaf6f7aa922280c978605450f18c297f88d2403e14e798733c3f28373a3892e4fae4edff4f4b334cd516
SSDEEP 49152:w/OJDcDk8QNGEADt7i+/yTukuFGNLrkBirx:EONchrSiGdkBirx
TLSH
T10206831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15E.tmp

Path C:\Users\Admin\AppData\Local\Temp\15E.tmp
Size 3.6MB
SHA256 1f76fa9931cdf8721a24105446c940cdfa3f34ce25fb5a6e05ac50ebcbb7622b
MD5 66072eedf76d9fe7b9e39c6175af52b8
SHA1 bf8b8a04d6b2f0c41bda42818238f5a1c440d482
SHA512 114893745284584f1022cd9dcb2cea0084bee552bd04bd9a77eada762e39c32a362b1f742d2d15fa0aced66ad69082f890a8189cd6b1cfe365d469ead53d4c1e
SSDEEP 49152:w/OJD1dhZfRgzNGEADt7i+/yTukuFGNLrkBirx:EOnBRWchrSiGdkBirx
TLSH
T17406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\15E0.tmp
Size 3.6MB
SHA256 fbdab79bab834e0f80a95d2ed2787288fbce40d50c4f062f322bef90aca09bca
MD5 839ee1368bd00570eb674a6f2cee7de3
SHA1 a5e550acf5d6669f7a252154674ff2a1e0bda818
SHA512 e74a3554c82c8824b400c3688921da4e2ad6f23c7ec45a781d43d0a7c505cdb944bfa0c6d8e76fbd6846dd20f3e4b045dbbf13617ae42e179ce8b524fa24ed09
SSDEEP 49152:w/OJD8pOkNGEADt7i+/yTukuFGNLrkBirx:EOi/chrSiGdkBirx
TLSH
T14206831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1831.tmp

Path C:\Users\Admin\AppData\Local\Temp\1831.tmp
Size 3.6MB
SHA256 fb2fae83aec842c115af3c0ec2f3d1ae330e8990648ccb2d584aa6f18748147c
MD5 d2e718f00abf3be6c1c5776c2d181b64
SHA1 0ef0b1caaa1b4cbab97b94e39176e10c8bf2ca10
SHA512 fefa8e089f9893ac6c9824beabecb56a182a4b1ced590ea9cc6f3a47d7f74d57fbadc4e69645ba2848410946c5ed7ed73e40165f9aa9d0863a05cd2e799c41fe
SSDEEP 49152:w/OJDiv06NGEADt7i+/yTukuFGNLrkBirx:EOYc6chrSiGdkBirx
TLSH
T1E506831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B00.tmp

Path C:\Users\Admin\AppData\Local\Temp\1B00.tmp
Size 3.6MB
SHA256 f2f9e17866fa4be65dd3546c34e07ed3da7c3b8bbaeeccf3422dc472ce241e4a
MD5 fa29821fe3660ee5d2d0e439805f642f
SHA1 f8d96c2898c50eaced492b9d7047f9fe35340999
SHA512 a4d9b4e7ee70d321663bd5d91164cbc7abf5897d6faf4ef2b917b7d410ff9c7b3c2c8680c2f7a6d174e488536a0daecace5975b28ffd879700a8795237a542bb
SSDEEP 49152:w/OJD/sgNGEADt7i+/yTukuFGNLrkBirx:EOugchrSiGdkBirx
TLSH
T19F06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D71.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D71.tmp
Size 3.6MB
SHA256 305b16b9a2417422c4fb2fdd1cd73bf4b4011b44be72e703ac5ca4a2db63c558
MD5 5034387d9c2087f48696b2ead2379ac1
SHA1 11bfb44d4b7e2def60153827ebcc5251de457d10
SHA512 5cf7723404d6e33b4f3d8aec76b3b84906de12f19743af93d26da773808645378dd1435eabfc2b6cb2592ef92cec22ce99370c64ccf4d02b99c6affae4ced872
SSDEEP 49152:w/OJDmgIA8EQNGEADt7i+/yTukuFGNLrkBirx:EO4chrSiGdkBirx
TLSH
T1F106931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\20BD.tmp
Size 3.6MB
SHA256 922887a1388e9874b9b08a5a8c74693c387d8b897ea566d6bca825c3d0375892
MD5 a1306f6b01dc706ed41fedc45ec4385f
SHA1 72193779b12d98dddacba93dfa1a3578e837702d
SHA512 7e5c000ce186eb3937ab9ca8e28638c4b03127f9e30949f42286e79a769badd92740a056e0cbb57c72c906b3751b95de02b7d62e78b5cee036e8350589402ea4
SSDEEP 49152:w/OJDjQyZeNGEADt7i+/yTukuFGNLrkBirx:EOKy8chrSiGdkBirx
TLSH
T1A406931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

232E.tmp

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp
Size 3.6MB
SHA256 9f3501b6cbf633e70bd47ae9f284deb3897765062970eca7cdff029fc51b6c7c
MD5 2e0bef15eb60285d21005dea59e683d6
SHA1 76d44a8cbd2767808bfc73235e8dc8485bac35fc
SHA512 ba31b4ecc1d7a7b9e6009da2f4ea6017f6f0bb61042915537fd55de318aafdd9425c2c5132604f57a5f501500163737a3760b7121b4a4ed00db7b68b92592748
SSDEEP 49152:w/OJDFWkpYNGEADt7i+/yTukuFGNLrkBirx:EOtYchrSiGdkBirx
TLSH
T14606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\25CE.tmp
Size 3.6MB
SHA256 d5db0a9d21c441d16ceb55ad66a5dc77baa7402581ef942f31abbe05aacc88c9
MD5 6d841d4492d30d49f4d79c48bb684efa
SHA1 9e9b5a0788a991cae7a00f8f0870b4e33c3d2d14
SHA512 a726024adfe03762f175e59124efd228e1bd862ee3cbc4d1cc99dcb123d066cb9a5d1d094d59f3365f88d30e0791a6ae8d6567c614362e859df2fac1738233a7
SSDEEP 49152:w/OJDUQAzRCNGEADt7i+/yTukuFGNLrkBirx:EOuQAzochrSiGdkBirx
TLSH
T11B06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2820.tmp

Path C:\Users\Admin\AppData\Local\Temp\2820.tmp
Size 3.6MB
SHA256 6ae41c64d63c2b11838621cbe688d8d93a7db02e2af404bfcd4767ac4e0b7859
MD5 379b576d85a1609b67940f8ab955f169
SHA1 c838898a3970c408cca74588161d406603e18e09
SHA512 5bf36f9f318f1300e3fd26ac06f804b63930dc5aed3b2a8002f6eb7392d68487cd603a128ec62a0cdd29b248389341aed6bfd76469fd9d7a824eb4fddb4baff2
SSDEEP 49152:w/OJDpehOeNGEADt7i+/yTukuFGNLrkBirx:EOa5chrSiGdkBirx
TLSH
T11106931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2AA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AA0.tmp
Size 3.6MB
SHA256 d1c00e71a421a9207b4b17167ca4394f84db9180504b0bbf68bc3d198b700b64
MD5 1f5e9cf381b90df13a4b92b44c951db2
SHA1 9cb1f90581cfae00bacf3f9cdb2cc930f07399da
SHA512 6e47e1696479872ead87cb3da2b0566e3cf19d8113bb8702df814a177f76a3685e836015af9b3138330dad7028ccd4d3e93c86e532f69f2c10cdbf4588f55652
SSDEEP 49152:w/OJDQPEo0otNGEADt7i+/yTukuFGNLrkBirx:EOIEo0otchrSiGdkBirx
TLSH
T1D806931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2C08.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C08.tmp
Size 3.6MB
SHA256 688c3e19ecf48ce295d1985b740211c3392a20e864c8548d8a6c2be159ebf8f6
MD5 7e481e3b207810b8fe3a0f653199a9cf
SHA1 97bd7bfa5a277dbd5e0630bf3fc9de928e58ebd9
SHA512 a0bae32f474266afa4512a7b32c94c4c120e86f4fa156a35039bed55b596755364fa41b396ff421c5d16a34a4340e3c01c435758f935045c7c9a6bec0512c87e
SSDEEP 49152:w/OJDYrMSNGEADt7i+/yTukuFGNLrkBirx:EOmrMSchrSiGdkBirx
TLSH
T1D306831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D5.tmp
Size 3.6MB
SHA256 09922ed3b37db72d3bd6fa9aa1da3774c5647eb1886b569f94604a53b8bc0773
MD5 f1329f14e0f75d09cef840b4d957b122
SHA1 d4617b7d3fd81240b9396b7f56df7064d0bfae8a
SHA512 582aa34dcd72c5a0013aa7d0cc417ef5ed0712df886696cc7fe1a5da71f99f3fbab3a77598d66718b08ffb2409f899bacea55b91f4916a81c9bb50ec870d03ba
SSDEEP 49152:w/OJDlVJ7VXNGEADt7i+/yTukuFGNLrkBirx:EOnVDXchrSiGdkBirx
TLSH
T1E406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2FB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2FB1.tmp
Size 3.6MB
SHA256 53aefadc0f5fd8e5656aa73bd53609f959158b7ca1a571f08fc40c41f9c1e5cf
MD5 1c4c57b36a681e095569c40dcc8ec6f0
SHA1 85cea0c9ea66414f2075a38bd6e82a2fb17d43a2
SHA512 eafcde1ac16927ad1f2230ef604c048355774c5be319c012150821ec634dd5fbac641858228edffffe722a0f4deb6990d8df041627ac1e55ed5b620f40852bdd
SSDEEP 49152:w/OJD9To1A4UunNGEADt7i+/yTukuFGNLrkBirx:EOPoEunchrSiGdkBirx
TLSH
T1F706931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3270.tmp

Path C:\Users\Admin\AppData\Local\Temp\3270.tmp
Size 3.6MB
SHA256 494077c3ad0385992a8d4de5e4ae8e43fdc4894cb6a3f448d8448c6f4f1ce66a
MD5 2a81f7daa0ff19d95b7706b767c971be
SHA1 459ae153e552487982e52af651cbb8606aab9a31
SHA512 1a2ac237ed8881786cb8dbac801a980514184180d67c771eca9efee045aead2796c09a03f842b9312a7ec205dc84eedb7ed061114d46534e7d06aa0d1a15a3ef
SSDEEP 49152:w/OJDD2hZKDdKNGEADt7i+/yTukuFGNLrkBirx:EOOEKchrSiGdkBirx
TLSH
T1E506931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3510.tmp

Path C:\Users\Admin\AppData\Local\Temp\3510.tmp
Size 3.6MB
SHA256 c174c2c4e768ece83498a203fe63c1438f7c06b0b83e4cc4489698fdf581d6ac
MD5 2799ed90c5633f565d9b067d3b298b37
SHA1 647761c7a44d2afd24ff408777476f53286ab21b
SHA512 f2f85bf889841ca86d47aa3a041a64ee9a483f00200d9d7365e40cc4c0d4ad30f0fb864b71379fde320588b01a909c7561351b832eba1d2651602ca6e177ceab
SSDEEP 49152:w/OJDomDNGyreNGEADt7i+/yTukuFGNLrkBirx:EOmmDHCchrSiGdkBirx
TLSH
T15906831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\37DF.tmp
Size 3.6MB
SHA256 1f369e4f14fa328c99ce598ef21603aaf0c8e14075b263fa6cec7eeed82fba54
MD5 2ebbc9eb71d1934d35295c5492877b62
SHA1 032f4d1405026c46e899f9adbc96db147970b90b
SHA512 8c21b26a4ca15cf40903b1ecfc532508e4f7d368681be13a71d732964de734f0668b150421d4cecd9a8b2ca61724564f14c0ac26495598a81b394ae138109d41
SSDEEP 49152:w/OJDTbUZoErNGEADt7i+/yTukuFGNLrkBirx:EOBpYchrSiGdkBirx
TLSH
T15D06931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3AAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\3AAE.tmp
Size 3.6MB
SHA256 1b03d6fb2951a063bf88e9e6709a2d78ad40e07e258233c002ae83edfce2aaff
MD5 244fc3626fe7a46b153dbfd25c2dd8a0
SHA1 d12e03688282b5e74721bf023b543430da177569
SHA512 b9131dd87c5dc6f901576d70b67df0378b7b520f244a2bc9af06b20b89b9df5fd6141a6619e933212cb5c67ac2b610206d19ceaeb30b87056daa96b3bea1caea
SSDEEP 49152:w/OJDJXfvHANGEADt7i+/yTukuFGNLrkBirx:EO7HgchrSiGdkBirx
TLSH
T1BC06831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3DF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3DF9.tmp
Size 3.6MB
SHA256 fed89b67557c628dba93ec94465adedefd9b41aa1a264e81564121be8554f431
MD5 3efd1a125100a7eab0034d5a60d43016
SHA1 589fef996175fe1ee567261407a3a49a807978be
SHA512 f3a03640e14d269ce65f97f8f924b054528128923730fbf313d052ebafdf9ca30880bd55056ec6c7e18f7e5fa01324900968ec26a3e9c1584fd5076e43848619
SSDEEP 49152:w/OJDItwXuGPNGEADt7i+/yTukuFGNLrkBirx:EORXuGPchrSiGdkBirx
TLSH
T1CA06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\40B8.tmp
Size 3.6MB
SHA256 27a404452eb053ddbdd1ece992202d8faeea875ead342a25533cd66779470561
MD5 9d0dfa0c140b28b5072e0a233370d7d1
SHA1 788ad2ffd4460a4f097153c69be97f413ddcfa04
SHA512 a49eb7a72bb88e7ce7d01c314e6bbe08c2eecda6657f68b8dc1572759acf82df3fce618aaf26b01da0ff68a975f9ff2bf1359b504530d0b56d8cce37b726454c
SSDEEP 49152:w/OJDBKDYhNGEADt7i+/yTukuFGNLrkBirx:EOzKDYhchrSiGdkBirx
TLSH
T13906931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\42FB.tmp
Size 3.6MB
SHA256 1713ae4cc6870b0e7010359a0186788256f8af7e02493f6fd7c38496b87f22e9
MD5 2d64b0390890fd17459d1b04776611f0
SHA1 3eb171d2d5835fc980456a5ade15c061de8b4c35
SHA512 92319c098307bb3d03005486c58c3b68f7a721b11c8a8379b59bd1e73a7affcac9b244eeff41254babd62115b853680b1fd5ea26ac180047841e9982a7740037
SSDEEP 49152:w/OJDg0m/ENGEADt7i+/yTukuFGNLrkBirx:EO1m/EchrSiGdkBirx
TLSH
T19206931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4452.tmp

Path C:\Users\Admin\AppData\Local\Temp\4452.tmp
Size 3.6MB
SHA256 e3fc829cd72300510c669fd948b342e1d31640aeaff844b7f1cacef0d045f7ab
MD5 bb8d77d070dc49ce659769e40f7880e7
SHA1 41b60784fec074341ae5e21ed6667df5db74d0f9
SHA512 1d1ee2696564237ec190d9222bdb20bc376d481e3c16c96916df98fc65278c569420982d1a7ccb36ffaec802256a1f2e4613022ddd1b23a2d529ee0dd5861c11
SSDEEP 49152:w/OJDsGSmdSNGEADt7i+/yTukuFGNLrkBirx:EOhSbchrSiGdkBirx
TLSH
T18806831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\47EC.tmp
Size 3.6MB
SHA256 d1c32cb37f7e3c5639a0d6366a605fd99fe182fe473eccf914e6713ea06a888d
MD5 296770455206e1fd4f021d35fe83859b
SHA1 f13c89ea17105ea0d4538f603cd58c8d62a04c01
SHA512 2e09d734165d5d17586122fa6b05da7526e410f3e0592a255cdfd4ec25a620d50557c892b5c94f69bf6a4113cbdababcc978370ddd71911b3b45bd2bb85cedb7
SSDEEP 49152:w/OJDhsplNGEADt7i+/yTukuFGNLrkBirx:EObolchrSiGdkBirx
TLSH
T1BA06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4AF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\4AF9.tmp
Size 3.6MB
SHA256 75889d95bd6c98194c99150de827b3c82fd09a8eb146820337f66b83fb792ba9
MD5 51435189913212470eeff399ac998f45
SHA1 2b5dce3ffb26708a1eb6c73097726b021a4a44ef
SHA512 5368834f2e6bbaa37037cb418565034eacd73032feb5890055474932c7b07e4ccd120dea134fef6fc950276a5abc08f7dbb7216f4c2087c7860c2ad2d5c8a4c9
SSDEEP 49152:w/OJDpWXMTxEEdNGEADt7i+/yTukuFGNLrkBirx:EO9V3dchrSiGdkBirx
TLSH
T11906931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D99.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D99.tmp
Size 3.6MB
SHA256 ed8e8eff29d78e9afa44d4e3375a8103bd18a4d36e2ffc0d201e8e58004e9475
MD5 b9d49a0c3308f237d1cd50208cac8aec
SHA1 552501c02e1a54c17f87e2e8be0eea88746047e3
SHA512 5483d7b6eec1269e7c9452cf5f06de99424c79eb843693c04c59bc781b26784e67479724df913763a77cbae8f3199730fb88c8b7bf9740aba84cd2db3ec88f21
SSDEEP 49152:w/OJDZdwwSsNGEADt7i+/yTukuFGNLrkBirx:EO9wwSschrSiGdkBirx
TLSH
T13006831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A7.tmp
Size 3.6MB
SHA256 d5aa3b6c8550dfb94445534bdc6ef5f879cdd6a3f93c9fdc2ef0a9c8bede82dd
MD5 cf70ba5622628b3874a589b7cdae18d3
SHA1 83d3156472df20d30dc2a4d2873b6ff0908ebdcc
SHA512 fdeab9ba6c6c5d8ab01bc44acd5952b8e82ccfe1fc351ae3ec2a2d1102349edf92945fccb1be6550a84251075e48599614e99b70071af6d7efba4d3459d6dea5
SSDEEP 49152:w/OJDt4PJFc6NGEADt7i+/yTukuFGNLrkBirx:EOqs6chrSiGdkBirx
TLSH
T17706831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A76.tmp

Path C:\Users\Admin\AppData\Local\Temp\A76.tmp
Size 3.6MB
SHA256 85eb4a526e814518c0b5c04bf5ac3ea686e5e62c064804844868404e835f98b6
MD5 09e69ea533dd7a00adf46181d044a6c2
SHA1 bad264a42d5daa291a02d48d35929dd28f8ec636
SHA512 d6f63d66b2dcd0035bda3b34d3a00129929e45be11eb8d257897b2f61d1bf4b786ebf2d40ae25880d229a9c7eacaa55d9f433e5df0bc0c2cf58a58e6ac2b34cb
SSDEEP 49152:w/OJDD/RhEBZXNGEADt7i+/yTukuFGNLrkBirx:EOpEHXchrSiGdkBirx
TLSH
T10F06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D35.tmp

Path C:\Users\Admin\AppData\Local\Temp\D35.tmp
Size 3.6MB
SHA256 8b3967a06d7d8bc83b74a17ecbf9937e427f55bb7bf5a6c60a411421883f8fa8
MD5 fb4b39e6ea98a1dad5dcc1c646344f67
SHA1 76ef432cbd24f1b9ec68c5e2c3314d763e4bb21e
SHA512 e10d55fecda74a666e03419e2bda397b0040771d41a564d79cc58926e3abfa511f9a8948846ee106cff978ae6b5c307fedce571c7725788576f306f86d448b61
SSDEEP 49152:w/OJDtOeECqNGEADt7i+/yTukuFGNLrkBirx:EOechrSiGdkBirx
TLSH
T1A406831137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FB34.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB34.tmp
Size 3.6MB
SHA256 ec886e99079c2a019b3fcd03c06c75986da1f25bb8672dd8fde2204879c6a940
MD5 bd84bbbddad6609bb89a530a35cd4624
SHA1 4ba34fc7e88bd6a355000fbbc0d5676ba466909c
SHA512 620deca9f6e72a89719436cfa7db3d102c88daa4797d1d7dc79f33b7fa582a87562a4077ab44ef6e4d307d47108ffc6b48d617d77cedebfdf98e14015a9c4c6e
SSDEEP 49152:w/OJDl6H5tUNGEADt7i+/yTukuFGNLrkBirx:EOOH3UchrSiGdkBirx
TLSH
T13C06831137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FC1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC1E.tmp
Size 3.6MB
SHA256 4d7864dbde763fd0f405a35e8933076e80987f049cf3fb444654ff9afd236464
MD5 c85d4368af8f479a43c2c98e3c06eba5
SHA1 33b366b64eb81a13e6500cc0dc3d6c726de5a6b9
SHA512 09114880fc94be68be87cd0d6a43d00be9711448e6084dfde2787fd81296408f44cc5a702d33b33810c683ec66aaa639a4fd9d43d210c3d59a2ef6df4b1be637
SSDEEP 49152:w/OJDT0CeKR18NGEADt7i+/yTukuFGNLrkBirx:EOZ0dKr8chrSiGdkBirx
TLSH
T17606931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FF3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\FF3B.tmp
Size 3.6MB
SHA256 2d93f2ed701c21c7dd12a93b4978c762f1b6491103536d743dbf20e6d05f1595
MD5 df945fae656098a43e1fb1b87924698b
SHA1 dc72cb6472a7c9bc201aa36d9468067f91a7abfe
SHA512 cef8ed830e0fb4045bf2bfb9765afd25d4160f7bcb1fa4699c5a9b0dd3179a9f18f3da0396f536d52287aa3f38064b567e8002e7efbbb236a7911d4134be466c
SSDEEP 49152:w/OJDGQ1rWjhNGEADt7i+/yTukuFGNLrkBirx:EOg9jhchrSiGdkBirx
TLSH
T1D206931137FAC635F2BF8B316EB2E694197BF9A29D51C25F2069424E1C35B408E63732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-103-0x00000000007D0000-0x0000000000853000-memory.dmp

Download

memory/8-110-0x00000000007D0000-0x0000000000853000-memory.dmp

Download

memory/236-132-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/236-124-0x0000000000210000-0x0000000000293000-memory.dmp

Download

memory/476-298-0x0000000000800000-0x0000000000883000-memory.dmp

Download

memory/564-239-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/564-233-0x00000000004E0000-0x0000000000563000-memory.dmp

Download

memory/808-145-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/808-138-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/944-269-0x0000000000D10000-0x0000000000D93000-memory.dmp

Download

memory/944-263-0x0000000000D10000-0x0000000000D93000-memory.dmp

Download

memory/1128-222-0x0000000000EF0000-0x0000000000F73000-memory.dmp

Download

memory/1128-215-0x0000000000EF0000-0x0000000000F73000-memory.dmp

Download

memory/1188-187-0x0000000000150000-0x00000000001D3000-memory.dmp

Download

memory/1188-181-0x0000000000150000-0x00000000001D3000-memory.dmp

Download

memory/1200-118-0x00000000009D0000-0x0000000000A53000-memory.dmp

Download

memory/1200-112-0x00000000009D0000-0x0000000000A53000-memory.dmp

Download

memory/1384-146-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/1384-153-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/1412-289-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/1412-283-0x0000000000F40000-0x0000000000FC3000-memory.dmp

Download

memory/1576-70-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/1576-61-0x0000000000B20000-0x0000000000BA3000-memory.dmp

Download

memory/1592-47-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/1592-56-0x0000000000310000-0x0000000000393000-memory.dmp

Download

memory/1612-35-0x0000000000E80000-0x0000000000F03000-memory.dmp

Download

memory/1612-26-0x0000000000E80000-0x0000000000F03000-memory.dmp

Download

memory/1844-159-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/1844-166-0x0000000000440000-0x00000000004C3000-memory.dmp

Download

memory/2236-174-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/2236-167-0x0000000000F90000-0x0000000001013000-memory.dmp

Download

memory/2244-223-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/2244-228-0x0000000000110000-0x0000000000193000-memory.dmp

Download

memory/2316-203-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/2316-194-0x0000000000A60000-0x0000000000AE3000-memory.dmp

Download

memory/2388-14-0x0000000000430000-0x00000000004B3000-memory.dmp

Download

memory/2388-5-0x0000000000430000-0x00000000004B3000-memory.dmp

Download

memory/2444-76-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/2444-83-0x00000000008C0000-0x0000000000943000-memory.dmp

Download

memory/2496-303-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/2512-268-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/2512-274-0x0000000000F00000-0x0000000000F83000-memory.dmp

Download

memory/2568-89-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/2568-82-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/2572-117-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/2572-125-0x00000000002E0000-0x0000000000363000-memory.dmp

Download

memory/2972-105-0x0000000000590000-0x0000000000613000-memory.dmp

Download

memory/2972-96-0x0000000000590000-0x0000000000613000-memory.dmp

Download

memory/3004-90-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/3004-97-0x0000000000570000-0x00000000005F3000-memory.dmp

Download

memory/3048-254-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/3048-248-0x00000000007B0000-0x0000000000833000-memory.dmp

Download

memory/3204-264-0x0000000000250000-0x00000000002D3000-memory.dmp

Download

memory/3204-258-0x0000000000250000-0x00000000002D3000-memory.dmp

Download

memory/3296-288-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/3296-294-0x0000000000AA0000-0x0000000000B23000-memory.dmp

Download

memory/3312-33-0x0000000000C10000-0x0000000000C93000-memory.dmp

Download

memory/3312-41-0x0000000000C10000-0x0000000000C93000-memory.dmp

Download

memory/3344-54-0x0000000000F20000-0x0000000000FA3000-memory.dmp

Download

memory/3344-63-0x0000000000F20000-0x0000000000FA3000-memory.dmp

Download

memory/3404-188-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/3404-196-0x0000000000A90000-0x0000000000B13000-memory.dmp

Download

memory/3532-173-0x0000000000360000-0x00000000003E3000-memory.dmp

Download

memory/3532-180-0x0000000000360000-0x00000000003E3000-memory.dmp

Download

memory/3572-131-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/3572-140-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/3588-216-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/3588-208-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/3672-0-0x0000000000350000-0x00000000003D3000-memory.dmp

Download

memory/3672-7-0x0000000000350000-0x00000000003D3000-memory.dmp

Download

memory/3904-244-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/3904-238-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/3924-253-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/3924-259-0x00000000002F0000-0x0000000000373000-memory.dmp

Download

memory/3972-243-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/3972-249-0x00000000000D0000-0x0000000000153000-memory.dmp

Download

memory/4228-19-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/4228-28-0x00000000008B0000-0x0000000000933000-memory.dmp

Download

memory/4268-293-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/4268-299-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/4460-273-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/4460-279-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/4484-75-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/4484-68-0x00000000002D0000-0x0000000000353000-memory.dmp

Download

memory/4668-48-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/4668-40-0x0000000000270000-0x00000000002F3000-memory.dmp

Download

memory/4912-229-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/4912-234-0x0000000000540000-0x00000000005C3000-memory.dmp

Download

memory/5376-152-0x0000000000CA0000-0x0000000000D23000-memory.dmp

Download

memory/5376-161-0x0000000000CA0000-0x0000000000D23000-memory.dmp

Download

memory/5556-20-0x00000000000E0000-0x0000000000163000-memory.dmp

Download

memory/5556-12-0x00000000000E0000-0x0000000000163000-memory.dmp

Download

memory/5900-202-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/5900-209-0x0000000000F60000-0x0000000000FE3000-memory.dmp

Download

memory/5972-284-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

memory/5972-278-0x00000000004D0000-0x0000000000553000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads