732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a

Resubmissions

24-10-2023 18:49

231024-xgcqbagg7t 10

24-10-2023 18:43

231024-xcw86agg5y 3

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtk.exe
Size

4.1MB
MD5

70c30480eb06b0183743d108788a2f2c
SHA1

84e4960ed1fad36636dde2be095e4ef330ba80e8
SHA256

732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a
SHA512

88f1555af06d66b62709e8f34241f14e9fdbdc56ee1aa847923509e2794637cee751d7e67993339542d9730f6953d5f96a8dec3e0e0b7cd3961c31f5086422b9
SSDEEP

49152:yJztu88Rw5yLMmRBOCWRgC4NqFgyMnQHhvwnKhTcF5UHsn3A1DNekUEmZT:tjFnkwssn3AN8E8T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

mtk.exe

description	pid	process	target process
PID 1440 wrote to memory of 3016	1440	mtk.exe	powershell.exe
PID 1440 wrote to memory of 3016	1440	mtk.exe	powershell.exe
PID 1440 wrote to memory of 3016	1440	mtk.exe	powershell.exe
PID 1440 wrote to memory of 1408	1440	mtk.exe	powershell.exe
PID 1440 wrote to memory of 1408	1440	mtk.exe	powershell.exe
PID 1440 wrote to memory of 1408	1440	mtk.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\mtk.exe
"C:\Users\Admin\AppData\Local\Temp\mtk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3016
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3016" "852"
    3⤵
    PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1408
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1408" "888"
    3⤵
    PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2704
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2704" "892"
    3⤵
    PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2808
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2808" "888"
    3⤵
    PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2788
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2788" "888"
    3⤵
    PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2764
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2764" "880"
    3⤵
    PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1980
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1980" "888"
    3⤵
    PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2708
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2708" "892"
    3⤵
    PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1656
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1656" "888"
    3⤵
    PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2968
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2968" "892"
    3⤵
    PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3008
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3008" "892"
    3⤵
    PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1900
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1900" "892"
    3⤵
    PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1052
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1052" "896"
    3⤵
    PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:436
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "436" "892"
    3⤵
    PID:4076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1060
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1060" "892"
    3⤵
    PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2068
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2068" "892"
    3⤵
    PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3040
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3040" "892"
    3⤵
    PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2000
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2000" "892"
    3⤵
    PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1404
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1404" "896"
    3⤵
    PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1036
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1036" "880"
    3⤵
    PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1924
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1924" "852"
    3⤵
    PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2028
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2028" "892"
    3⤵
    PID:4060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 832
    3⤵
    PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1132
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1132" "860"
    3⤵
    PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:896
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "896" "892"
    3⤵
    PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1740
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1740" "892"
    3⤵
    PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1472
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1472" "884"
    3⤵
    PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1164
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1164" "888"
    3⤵
    PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2012
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2012" "852"
    3⤵
    PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2836
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2836" "888"
    3⤵
    PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2120
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2120" "888"
    3⤵
    PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:432
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "432" "892"
    3⤵
    PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2492
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2492" "892"
    3⤵
    PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1356
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1356" "888"
    3⤵
    PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1556
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1556" "884"
    3⤵
    PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2748
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2748" "892"
    3⤵
    PID:1900
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 832
    3⤵
    PID:7376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1500
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1500" "888"
    3⤵
    PID:6352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1920
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1920" "884"
    3⤵
    PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2136
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2136" "844"
    3⤵
    PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3024
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3024" "852"
    3⤵
    PID:592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2304
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2304" "892"
    3⤵
    PID:1628
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 832
    3⤵
    PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2628
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2628" "892"
    3⤵
    PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2824
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2824" "892"
    3⤵
    PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2464
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2464" "888"
    3⤵
    PID:6744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2100
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2100" "888"
    3⤵
    PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2976
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2976" "888"
    3⤵
    PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2104
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2104" "888"
    3⤵
    PID:4084
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 828
    3⤵
    PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1764
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1764" "860"
    3⤵
    PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2668
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2668" "884"
    3⤵
    PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2460
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2460" "888"
    3⤵
    PID:6732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2328
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2328" "884"
    3⤵
    PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:672
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "672" "892"
    3⤵
    PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1056
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1056" "888"
    3⤵
    PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1996
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1996" "892"
    3⤵
    PID:5176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1660
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1660" "884"
    3⤵
    PID:7260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2924
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2924" "892"
    3⤵
    PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1580
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1580" "892"
    3⤵
    PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 860
    3⤵
    PID:6484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3328
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3328" "832"
    3⤵
    PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3500
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3500" "872"
    3⤵
    PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3680
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3680" "836"
    3⤵
    PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3844
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3844" "836"
    3⤵
    PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3800
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3800" "892"
    3⤵
    PID:6548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3852
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3852" "832"
    3⤵
    PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3776
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3776" "832"
    3⤵
    PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3712
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3712" "872"
    3⤵
    PID:6648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3860
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3860" "836"
    3⤵
    PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3884
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3884" "832"
    3⤵
    PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3896
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3896" "836"
    3⤵
    PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3668
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3668" "892"
    3⤵
    PID:6660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3628
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3628" "836"
    3⤵
    PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3584
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3584" "892"
    3⤵
    PID:5928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3548
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3548" "876"
    3⤵
    PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3520
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3520" "892"
    3⤵
    PID:6708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3348
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3348" "892"
    3⤵
    PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3308
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 860
    3⤵
    PID:6492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3264
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3264" "892"
    3⤵
    PID:4016
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 832
    3⤵
    PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3224
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3224" "892"
    3⤵
    PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3208
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 864
    3⤵
    PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3160
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3160" "896"
    3⤵
    PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3140
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3140" "892"
    3⤵
    PID:5124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2168
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2168" "892"
    3⤵
    PID:6320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2832
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2832" "892"
    3⤵
    PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1744
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1744" "848"
    3⤵
    PID:112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1504
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1504" "892"
    3⤵
    PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2840
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2840" "888"
    3⤵
    PID:6696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:332
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "332" "892"
    3⤵
    PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2528
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2528" "836"
    3⤵
    PID:5568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3324
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3324" "872"
    3⤵
    PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3480
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3480" "876"
    3⤵
    PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3452" "872"
    3⤵
    PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3368
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3368" "832"
    3⤵
    PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4092
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4092" "836"
    3⤵
    PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3648
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3648" "832"
    3⤵
    PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:268
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "268" "832"
    3⤵
    PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2928
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2928" "832"
    3⤵
    PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1944
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1944" "832"
    3⤵
    PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2620
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2620" "876"
    3⤵
    PID:4008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3956
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3956" "832"
    3⤵
    PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3280
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3280" "840"
    3⤵
    PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4116
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4116" "836"
    3⤵
    PID:5168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4124
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4124" "836"
    3⤵
    PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4136
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4136" "856"
    3⤵
    PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4156
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4156" "832"
    3⤵
    PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4176
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4176" "872"
    3⤵
    PID:7072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4048
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4048" "836"
    3⤵
    PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4196
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4196" "836"
    3⤵
    PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4236
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4236" "876"
    3⤵
    PID:6672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4268
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4268" "836"
    3⤵
    PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4308
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4308" "876"
    3⤵
    PID:6636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4396
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4396" "880"
    3⤵
    PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4476
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4476" "872"
    3⤵
    PID:6684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4516
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4516" "832"
    3⤵
    PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4544
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4544" "872"
    3⤵
    PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4584
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4584" "872"
    3⤵
    PID:6720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4672
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4672" "836"
    3⤵
    PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4632
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4632" "888"
    3⤵
    PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4716
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4716" "872"
    3⤵
    PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4764
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4764" "836"
    3⤵
    PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4212
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4212" "876"
    3⤵
    PID:7816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4860
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4860" "868"
    3⤵
    PID:4036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4872
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4872" "876"
    3⤵
    PID:7844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4012
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4012" "832"
    3⤵
    PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4920
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4920" "872"
    3⤵
    PID:6332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4972
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4972" "832"
    3⤵
    PID:4332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5024
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5024" "872"
    3⤵
    PID:8916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:688
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "688" "852"
    3⤵
    PID:5780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2912
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2912" "832"
    3⤵
    PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5100
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5100" "832"
    3⤵
    PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:612
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "612" "832"
    3⤵
    PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4264
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4264" "872"
    3⤵
    PID:9060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3424
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3424" "832"
    3⤵
    PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1068
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1068" "832"
    3⤵
    PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4352
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4352" "872"
    3⤵
    PID:9100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3988
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3988" "872"
    3⤵
    PID:8732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4740
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4740" "832"
    3⤵
    PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4108
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 844
    3⤵
    PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4824
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4824" "832"
    3⤵
    PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1608
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1608" "872"
    3⤵
    PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2160
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2160" "832"
    3⤵
    PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4880
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4880" "872"
    3⤵
    PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1476
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1476" "872"
    3⤵
    PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2384
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2384" "872"
    3⤵
    PID:8128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1676
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1676" "836"
    3⤵
    PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4888
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 848
    3⤵
    PID:6500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4068
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4068" "836"
    3⤵
    PID:5196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1964
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1964" "836"
    3⤵
    PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:852
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "852" "876"
    3⤵
    PID:6768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3380
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3380" "872"
    3⤵
    PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5400
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5400" "876"
    3⤵
    PID:6180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5532
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5532" "872"
    3⤵
    PID:6756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5472
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5472" "876"
    3⤵
    PID:7896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5732
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 836
    3⤵
    PID:8588
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5732" "948"
    3⤵
    PID:8052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5428
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5428" "872"
    3⤵
    PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1968
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1968" "876"
    3⤵
    PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3048
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "3048" "880"
    3⤵
    PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5812
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5812" "884"
    3⤵
    PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:832
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "832" "884"
    3⤵
    PID:9244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2792
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2792" "884"
    3⤵
    PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5520
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5520" "884"
    3⤵
    PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1356
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1356" "900"
    3⤵
    PID:9388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2916
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2916" "888"
    3⤵
    PID:5344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4820
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4820" "884"
    3⤵
    PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2612
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2612" "896"
    3⤵
    PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1020
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "1020" "884"
    3⤵
    PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5876
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5876" "880"
    3⤵
    PID:10716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2716
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2716" "852"
    3⤵
    PID:9376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6092
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6092" "880"
    3⤵
    PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4104
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4104" "392"
    3⤵
    PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5900
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5900" "880"
    3⤵
    PID:5484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5504
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "5504" "880"
    3⤵
    PID:9360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2400
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2400" "884"
    3⤵
    PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4016
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "4016" "892"
    3⤵
    PID:9364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6212
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6212" "808"
    3⤵
    PID:9336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2616
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2616" "876"
    3⤵
    PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6832
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6832" "888"
    3⤵
    PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6872
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6872" "892"
    3⤵
    PID:10260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6960
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6960" "888"
    3⤵
    PID:9904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6608
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6608" "892"
    3⤵
    PID:9680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2492
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2492" "888"
    3⤵
    PID:8044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6384
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6384" "884"
    3⤵
    PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6316
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6316" "892"
    3⤵
    PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6804
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6804" "888"
    3⤵
    PID:10008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6136
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6136" "892"
    3⤵
    PID:10832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7252
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "7252" "888"
    3⤵
    PID:10468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6328
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "6328" "888"
    3⤵
    PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7288
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "7288" "884"
    3⤵
    PID:10352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7804
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "7804" "880"
    3⤵
    PID:10968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8140
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "8140" "880"
    3⤵
    PID:10900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:7632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:8320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:9280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "& 'C:\Windows\Temp\37b712b3-3f0d-4935-82e8-4bc99dc88402.ps1'"
  2⤵
  PID:10840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259403987.txt

Filesize
1KB

MD5
dd7c2d631fd4258ca2704df759d1efb9

SHA1
bf6d123ce7c157d2c3747ebdc8213fdc6db14a46

SHA256
e94bf3cd93cdfb52cdcd7b2a148f246e07a58e45d35841e15d8dfe35cd263ebd

SHA512
580fcaf5fe716fe31a5a0d887ba48cdcbc3b87c50fcec623c1bb8bd0e4905f38e4accca38e03bf2bd55961dcf2b95219f3d2bc761e92c6297ab27042fcdbce23

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259406900.txt

Filesize
1KB

MD5
bafeed6a6773db308b776f687daa5b31

SHA1
5360b00655e2ac9cf5e3b1c504184d2c77ca35aa

SHA256
edb858320de97f5a0dc0cc1b20763a5a7ca3085f754d6467d98d8bfd1eb5571e

SHA512
4928987772f474fd7575bfde0cf6353fd4574d90d77c60306d90014833ef71fd137857cd537e3d7499928b2596ee1d4d7ccbcd90759a0ad81723962737f4f752

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259406942.txt

Filesize
1KB

MD5
d1c31260958452efd4f3a1891d4f9f71

SHA1
e2b5b2f543b8be8a3ce7c28a6655418d1121fddc

SHA256
44e2d41147e6bcccb8ae3471c2bd83365723f45aa719d748239a2c0ecdbc4553

SHA512
f396566fbdbdaa8484d318fba3d9c6d7e3fb1f65154161d0af6ac626c04ab86f6412db99f502c3f0e84c2c55f6568bc0bc132f1540c3fc4fcf6a6fdb41017e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259407515.txt

Filesize
1KB

MD5
96447c9ce6b8fb8f1aacf57164c0a07b

SHA1
b94dbe66eb9175b8c20496319c7c1508c8909ddd

SHA256
449c9f5e04397a2d45859a87a818de0cae724e94f944b4bcd6bda98cfe727f27

SHA512
1a99d470d0079d38e82e3d81641f5d2e075b6c756096a30f28ffb826964f5ec6ffe1aab029f73a7cd92943d17901cd4ebf7bf6ed4879c493bd2c8ae6ff120582

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259407622.txt

Filesize
1KB

MD5
6d476c425606dff77bb1a93573fbe308

SHA1
e08c914e3ff420189aeea4350cfaf57390279676

SHA256
277f9e3bb43c82ff6c47be9d84b1fd1caa0855f9c73bc619949c34799c409a77

SHA512
ffaf370dc96df23fc168f448ac835eaf921689c2fd3ed8593f7986744471a87e7b38e8b7821460bddeff77cb0e666d0b666be35ae86fdb06786af8aef2811cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259408936.txt

Filesize
1KB

MD5
bab3fecd388ead9b539141b94ecc3f3a

SHA1
b56fb3da333bfedf1fe226b4d719b59c1ca5b259

SHA256
291200cd859876bc0ba4094f7ab3e7f1fa59268f4cf42c0745d1fdcc74fc4e4f

SHA512
55422ca567700727a7ea81b8ed2d9124df89e58625a8740110b8e465d69fbcd703c242be7c14bdb9bbe836790fa335885917153eab5a8f24d32d2e8174c00eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259410124.txt

Filesize
1KB

MD5
aa4193832dfd3a6d559cbb1700dc3e10

SHA1
299b58cc7be12ecc0b79ade0de68c15e08460b9a

SHA256
eaaf8637a5dbfdb843a73ac5e527eaa7d7e67040acfc76802bbb65d3948dbba5

SHA512
74f479de63b445ddca0e18a099eda2f2c251b241e546217209b1f33f46a26d1c6f8f9f496183d3fb7c2b434597a1f0813617ad1d0a2096a34c51bad051d5397a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259410164.txt

Filesize
1KB

MD5
f8785dd7af18b654e0e2839dcbad5ba1

SHA1
2458fafa0a0f69b5ed26dfe83eaf2a190564c624

SHA256
6bb164604c05f56a051088f9b5c85e69b26ee7c5c0db94681e24bc2e0b23437c

SHA512
d8cfa0326fa7fdf47c403f5d18f5ca04cffaabaeff3dfd82a313391f453d3ef651e5898a863d76979c4fd48a2a9103c49bd79d81c06789bc09e2ca458aa98c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259410576.txt

Filesize
1KB

MD5
361862dfb4e153f088754c4ffb2528ce

SHA1
582383d9cf9cfb3a382d071c8a46356f3467922b

SHA256
c300118d33dc35a661690605a6e420b9076a78d386ec07fdea5da2f79716a0fc

SHA512
d26e25adcd419caff2f1ed65f2329117abf4af5b0234ef4c9deb56a0ea3417e5e38ed5ab21a064c04710ee426784952a7b7e2c6fe2ef9966a0dc0c3acdf3e714

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259412137.txt

Filesize
1KB

MD5
4b3aa45a6972ebc84a11833eb037a9b2

SHA1
7b486734d7a1089af4b0f9e844d0d3b2ddef6e24

SHA256
be11dab372487136e2a1760edd3f146328eed13d7c76c7ae46a38c1065b9eb99

SHA512
5cfbe6c8c5c32e6399f57e0fb12b90078dd0f4de6ca938dfbb37ac91a70255597b8faf2a2757206417c28fded41af6d49335d1dff19d41ff7a00e77457cce396

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259412426.txt

Filesize
1KB

MD5
be4dd361d66e5a31f3f8ebb78c19218d

SHA1
7a32c72168809ba0b7766f7c05bd331010fc9c1c

SHA256
91018ef3108f98e823abc98ab66b91b4442f2f2430832e2ed1945d0f24edb942

SHA512
e538a4379591529eadcefc3792b6eac251136bede445810d2ba6c58fdcbb4c37408d7deb9b190de3d4019f93958c99414adc399d53375e34f26409595896801f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259413016.txt

Filesize
1KB

MD5
9e7bab3d51319cacdf7f91a877529b4d

SHA1
6e059f2a97b999bde93018d52fd7cf50fb4fd2e7

SHA256
a24a4da1e790cdc1eba402d127dc8403c6b418d164b61cbabf9c9ebcc9483ac4

SHA512
1f6c8e227aab5d3233277b0fb20c207ccb9fd94f3e79ae1fa1bcce3c2ee0e3ca7dea168f9bdcd50bbfdaac952e07543b73d69e6bf3d2001c23932b3df7412445

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259413044.txt

Filesize
1KB

MD5
1134e7640695c0b3c1ff68fcfebc05af

SHA1
169a0001f7c654be0cd2715154340b6205e23f86

SHA256
6c1450068b37ef98162d1c519dbe896d52b43cfd5791b714a8ae9d8d5ad49972

SHA512
0c23feab23d82974130edc7bf789af73ad36fb8cc2a231692fb5586f3b48d8ee8d15b9a07ebe1e44a0ce82b03d954c3bf446d108c225faadec301d79d89aeb1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259413141.txt

Filesize
1KB

MD5
c263d0488b29f2d65307933d5b796e0a

SHA1
d41f5bea62feae209da239207b4aa5234460115d

SHA256
4d55556fcf99a057ccf5e260af0442bd08c4fb120641d6638c7b4436883cfaaf

SHA512
73a4bcc10ce8d00b822846505c6af79a6489729df8599f5d399ce01bb988b62e550a8a732fec90686af4ebb0fa33d4f168962d6abf5cc6c6946edae5c09a4ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259413526.txt

Filesize
1KB

MD5
82147314524594136ab136b603c3d353

SHA1
a9465dd4bd0d13e1dcab39a72eca1ae9fa08adc7

SHA256
4128b18b95bf3d68e3ec0131bf1c99a93c861dad14838482e0ee1e73286d53cf

SHA512
391ca1953970935843a1df1f1100bb01d4cfc077db24bbedf699e347fca86d1bbeacc5f063b358b6e4c3118758f770035f2e4e296c1d7bb97972fbb2f167e42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259414344.txt

Filesize
1KB

MD5
a8a2e23468867fffa83f641d69c53f9d

SHA1
089ff8f167fda1bc6ae4e11aa0f173d602e847ba

SHA256
28975cdbdc8994f07866dc9af3d095c7d268c8860c5180e6467f622290082ce8

SHA512
166a14f5ab890085fdaf18700e5b1a07400b0c3cea80465f19f7516ba7371189e3f515f070e7a11048bed00f9b040d348dee8891b23bb02068bd5fbd147050ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259414517.txt

Filesize
1KB

MD5
c7196bed31069af9d245f07f048b218f

SHA1
edca0be9cdbafe24d3541b5c1e9f1411e6efce2e

SHA256
31eb03b6ba3212989bc7dfebb14c92657ec86a0aab88ddbb0128f16d41016b9d

SHA512
f33474edc6f6d9af6691aa4fe98a69de306bbb94f4cf2d0ac6536a5889376ef4a934837800ca656e8558ad9c1985266fec29b3459658ab2089386f6e1b9dcf5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259414553.txt

Filesize
1KB

MD5
f2b67264fa4fdbb1b3a7ef9b2fc0fc07

SHA1
41130ecffb42e03efd5108e883d655845a29fec4

SHA256
94aa6d7b9e66aa937ad91ce17be51460bc55400103b78bd2925063fbdc16ed1d

SHA512
2e3295adaa505641724a5be4434e90a895718deda1f52b0facaaf4ab0b22de63f9477ae1a6f0181315ee747bd5c47f252a9e534f9e5144f611fb3ed7e0f44195

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259423563.txt

Filesize
1KB

MD5
ca87c77084a57aafdefcb41b0f48e484

SHA1
7810105b8cae23751d05ca5e44f4b252ccac2731

SHA256
0e5bd23c821006ac02a18b4116701b5f14c9de76080519a3844d159e8b66668d

SHA512
75529af3ccd39e2a68007d02d28c6ace23097315e81595e18647c7de1fb2cbbacf9208c52b93fa39f0870c830050ec012e51151b35af5f9dc3edd001b1bf54f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9WPDPYY39J3ZPLW578WR.temp

Filesize
7KB

MD5
6b9b50dc61c572fc26d32e405f82e928

SHA1
3a241ba47eac000afddd0455760e8e856418719b

SHA256
f9c57277fe26ce4395bf0d062b9fbef1779e82ac7b6f3391f76300e94d49dcd7

SHA512
66c0a21e3ca027108d5cfe1617841df7739322b622caa17f33a8c98824f5c1102980ecd2dbb48028332e17816de63ab7176664e3148318c823e86484556a75d5

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/436-253-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/436-145-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/896-328-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/896-301-0x0000000002414000-0x0000000002417000-memory.dmp

Filesize
12KB

Download
memory/1052-188-0x0000000002A90000-0x0000000002B10000-memory.dmp

Filesize
512KB

Download
memory/1052-225-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1052-187-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1052-254-0x0000000002A94000-0x0000000002A97000-memory.dmp

Filesize
12KB

Download
memory/1060-291-0x0000000002904000-0x0000000002907000-memory.dmp

Filesize
12KB

Download
memory/1060-229-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1408-96-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/1408-105-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/1408-7-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/1408-98-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1408-135-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1408-111-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/1472-169-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/1472-146-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1472-369-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1472-148-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/1472-147-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/1656-376-0x0000000002A64000-0x0000000002A67000-memory.dmp

Filesize
12KB

Download
memory/1656-371-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-327-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-337-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1900-153-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1900-152-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-370-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-372-0x00000000029E4000-0x00000000029E7000-memory.dmp

Filesize
12KB

Download
memory/2000-230-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2000-205-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-189-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-149-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2708-143-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-144-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/2708-138-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/2708-349-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-352-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/2764-136-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2764-130-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-132-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2764-131-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2764-156-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2788-127-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2788-128-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2788-129-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2788-155-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2788-126-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-123-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-124-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/2808-137-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-125-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/2808-112-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-150-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/3008-377-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/3008-373-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-151-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-110-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Filesize
512KB

Download
memory/3016-104-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Filesize
512KB

Download
memory/3016-84-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/3016-9-0x00000000024D0000-0x00000000024D8000-memory.dmp

Filesize
32KB

Download
memory/3016-86-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Filesize
512KB

Download
memory/3040-166-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/3040-154-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download